An ongoing Microsoft 365 phishing campaign targeting organizations in healthcare, education, manufacturing, government, professional services, and other sectors across the United States, Canada, and Europe.
The campaign, linked through technical and behavioral overlaps to the Payroll Pirates activity cluster known as Storm-2755, uses adversary-in-the-middle (AiTM) phishing pages to steal authenticated Microsoft 365 sessions.
The attackers are primarily interested in employees who handle payroll, HR, finance, invoices, payments, and banking information. Unlike basic credential phishing, this operation can work even when multi-factor authentication is enabled.
The AiTM proxy relays the real Microsoft login process in real time, allowing victims to complete MFA on what appears to be a legitimate sign-in page.
The attackers then intercept the resulting session material and use it to access the account.
Payroll Pirates Hijack M365 Sessions
The campaign begins with voicemail-themed phishing emails impersonating an automated call-notification service. Messages use Microsoft branding and include fabricated caller IDs, dates, durations, and reference numbers to create urgency.
Observed subjects follow a pattern similar to:
[Organization] :ATTN: Review messages. Ref id: [random string]
Victims are asked to click an “OPEN [Organization] VOICEMAIL PORTAL” button.
The embedded URL uses several legitimate services as redirect stages, including Google Meet link redirects, Google advertising infrastructure, Campaign Manager click tracking, and Amazon S3-hosted content.
This layered redirect chain helps the attackers evade reputation-based security controls. The final destination is a recently registered, attacker-controlled domain that acts as an AiTM authentication proxy.
The infrastructure commonly uses redirector domains with idp. subdomains before sending victims to Microsoft-themed phishing domains.
These domains may include subdomains such as mslogin, msonline, or msauth, designed to appear trustworthy at a glance.
Before loading the proxied Microsoft login page, the toolkit fingerprints the victim’s browser.
![JavaScript returned after browser fingerprint submission queries api[.]country[.]is, stores the resulting country code in the rcfh_country cookie for seven days, and redirects the victim to the proxied Microsoft OAuth authorization endpoint (Source: arcticwolf)](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjdksl8z4UZujwJS_DnYTyo0A4IIVLb0N2MlBTxDhsUGUwFjh5bVrtmJJGzPFCi7C8ieFufPts5aYgQrHsyAQs5g9EWQMVIh2Sewh2xLEzra5LXXGvG0mxjk7RgoJ_g65DNWgcK3Ysbw7wGhY1E5fmnHLUS9SGobBWECpTIxJEFGrzVI4_WZInhTJmxjc8F/s1400/payroll-pirates-fig03b.webp)
JavaScript gathers browser, operating-system, screen, language, timezone, hardware, WebGL, cookie, and WebDriver details. It also checks the visitor’s country through a geolocation API and stores the result in a cookie.
This information may help attackers identify security researchers, automated sandboxes, and instrumented browsers.
It may also support use of residential proxy infrastructure located near the victim’s country, making malicious activity appear more legitimate.
Once a victim authenticates, the AiTM server proxies legitimate Microsoft OAuth pages and captures session-related material before redirecting the user to the real Office 365 site. The victim may not notice anything unusual, arcticwolf said.
Within minutes, suspicious OfficeHome sign-ins may begin from residential or mobile proxy networks.
Some affected accounts showed rapid sign-ins from several residential IP addresses, unusual browser and operating-system combinations, and Microsoft error code 90014 linked to OfficeHome authentication.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
