The emails that successfully move company money are almost always the quietest in the inbox. When adversaries weaponize trusted enterprise infrastructure, standard authentication checks confirm that the infrastructure itself is real, but they fail to ask what the message actually wants to achieve.

The "Payroll Pirates" campaign (Storm-2755) is an active, financially motivated phishing operation that hijacks Microsoft 365 accounts to quietly search finance and payroll mailboxes. Earlier waves of Storm-2755 relied on SEO poisoning and malvertising—pushing fraudulent domains like bluegraintours[.]com to the top of search results for queries like "Office 365". However, the July 2026 wave observed by Arctic Wolf Labs shifted heavily to email delivery. The operators utilize sophisticated adversary-in-the-middle (AiTM) techniques to steal active session cookies and OAuth access tokens at the exact moment they are issued. This allows attackers to take over accounts and blend into legitimate user activity without ever needing a password or defeating MFA directly.

The Six-Stage Attack Chain

The Payroll Pirates string together legitimate services so that no single hop triggers a block from legacy secure email gateways (SEGs).

The 6-Stage Evasion Chain:[ Fake Voicemail Lure ] ➔ [ Google Meet Redirect ] ➔ [ Campaign Manager Tracker ] ➔ [ AWS S3 HTML Object ] ➔ [ Fingerprint Cloaking Gate ] ➔ [ AiTM Proxy ]

1. The Lure: Victims receive a fake voicemail notification email containing a Microsoft logo, fabricated call details, and a reference number to create a false sense of urgency. The email prompts the user to click an "OPEN [Organization] VOICEMAIL PORTAL" button.
2. Reputation Laundering: The link routes through a Google Meet redirect URL, Google's outbound link infrastructure, and a Campaign Manager dynamic click tracker.
3. The Cloaking Gate: The redirect chain lands on an HTML object hosted in an Amazon S3 bucket. Before presenting the fake login, this page quietly fingerprints the visitor's browser and checks their country. The attackers use this data to filter out automated security scanners and pick a matching proxy so subsequent malicious logins appear local.
4. Real-Time AiTM: Victims who pass the gate are delivered to a fake Microsoft login sitting on a lookalike domain, usually a misspelled "Office" name registered only days earlier. This proxy passes the victim's login straight to the real Microsoft infrastructure in real time. The attacker captures the live session token, bypassing MFA entirely.

Post-Compromise: The 8-Hour Shift & Graph API Recon

Once the session is hijacked, the attackers operate quietly to avoid triggering standard identity alerts, creating a highly specific forensic footprint for SOC teams to hunt.

• Session Persistence: Automated logins refresh the stolen session approximately every eight hours. Initial failed attempts frequently produce ResultType 90014 (a required credential field was missing) originating from US mobile carrier IP space. To maintain the sessions, the attackers utilize rotating residential ISP addresses, frequently displaying an anomalous Axios 1.7.9 user-agent string instead of a standard browser.
• Graph API Reconnaissance: Rather than merely searching the mailbox, the attackers query the Microsoft Graph API at [graph.microsoft.com/v1.0/users](https://graph.microsoft.com/v1.0/users). They use filters for attributes to build a target list directly from the tenant's directory, hunting for staff in payroll, HR, and finance.
• Defense Evasion & Payroll Diversion: Attackers locate emails concerning invoices, banking, and direct deposits. To hide their tracks, they create inbox rules that automatically move incoming emails containing the keywords "bank" or "direct deposit" to hidden folders, suppressing alerts from HR. If emailing HR fails, they use their authenticated session to log directly into platforms like Workday and manually update the employee's banking information, successfully redirecting the salary.

The TRACE Detectability Assessment

The only way to catch an AiTM campaign built entirely from legitimate components is to analyze its underlying intent. StrongestLayer’s TRACE engine achieves a confident pre-delivery block against the Payroll Pirates by breaking down the attack structurally at the email layer:

• Intent Reasoning (Verdict: DETECT): TRACE successfully extracts the high-risk intent of a voicemail portal pretext attempting to funnel a user into a Microsoft sign-in directly from the email body.
• URL Detonation (Verdict: PARTIAL): While the live redirect chain is detonatable, the fingerprint/geo-cloaking gate can serve benign content to automated scanners, making isolated detonation unreliable.
• Attachment Analysis (Verdict: BLIND): This is a link-only attack with no malicious payload attached.
• Sender / Auth Signals (Verdict: PARTIAL): The spoofed notification service provides some anomaly signals, but delivery can occasionally pass basic checks.
• LLM Final Verdict (Verdict: DETECT): By fusing the intent reasoning, the live URL chain characteristics, and the sender pretext, the TRACE LLM reaches a confident "DETECT" verdict before the email is delivered to the inbox.

Beyond Payroll Pirates: The Watchlist

The weaponization of legitimate SaaS platforms and authorization flows is accelerating. Our threat intelligence team is actively tracking secondary campaigns that utilize similar evasion techniques:

• Doubloon Dredger & EvilTokens: This financially motivated threat actor abuses legitimate Notion infrastructure by creating fake accounts that impersonate senior executives. They send document-share notifications containing a malicious link to an intermediary PDF, redirecting victims to an EvilTokens device-code harvesting page to steal authorization tokens.
• Mirage2FA (LinXcoded): An AiTM phishing-as-a-service (PhaaS) platform delivered via secure document and payment-themed lures. It utilizes short-lived HTML smuggling and obfuscated JavaScript loaders to present a Microsoft-branded phishing interface designed to intercept MFA workflows.

Stop AiTM Attacks Before the Click

Advanced campaigns use fingerprint and geo-cloaking to serve benign content to security scanners, causing traditional URL detonation to achieve only a "PARTIAL" verdict against this threat. StrongestLayer’s TRACE engine eliminates this blind spot by fusing intent reasoning with the URL chain to reach a confident "DETECT" verdict before the email is ever delivered.

Final Thoughts

The "Payroll Pirates" (Storm-2755) campaign represents a defining shift in the threat landscape. Attackers no longer need to write custom malware or exploit complex zero-day vulnerabilities when they can simply abuse the inherent trust of cloud infrastructure (Google Meet, Google Ads, AWS S3) and the inherent flaws of password-based MFA.

As legacy SEGs struggle with reputation laundering and fingerprint cloaking, security teams must recognize that infrastructure reputation is no longer a proxy for safety. Defending against modern AiTM campaigns requires moving beyond static domain checks and signature matching toward real-time intent reasoning—analyzing what a message is trying to achieve before it ever reaches the user's inbox.

Frequently Asked Questions (FAQs)

Q1 What is the primary objective of the "Payroll Pirates" (Storm-2755) campaign?

The primary objective is financial fraud through payroll diversion. Once attackers hijack an employee's Microsoft 365 account, they conduct internal reconnaissance using the Microsoft Graph API to target HR and finance personnel. They then alter direct-deposit banking details—either by submitting fraudulent requests to HR or by logging directly into HR platforms like Workday—to redirect upcoming salary payments to attacker-controlled accounts.

Q2: How does the Payroll Pirates campaign bypass Multi-Factor Authentication (MFA)?

The campaign uses an Adversary-in-the-Middle (AiTM) proxy architecture. When a victim clicks the phishing link and enters their credentials on the lookalike site, the proxy relays those inputs to the legitimate Microsoft login endpoint in real time. The user completes the MFA prompt on their authentic authenticator app or device, but the proxy intercepts the resulting post-authentication session cookie/token. The attackers then import this token into their own session, giving them full account access without needing to defeat the MFA mechanism itself.

Q3: Why do traditional Secure Email Gateways (SEGs) fail to block these emails?

Traditional SEGs fail primarily due to reputation laundering and fingerprint cloaking:

• Reputation Laundering: The initial links in the email route through highly trusted domains (Google Meet, Google Ads outbound links, AWS S3 buckets), which pass standard domain reputation checks.
• Fingerprint Cloaking: The intermediate landing pages run client-side JavaScript checks (evaluating WebGL, WebDriver status, and user IP location). If an automated security sandbox or security vendor IP is detected, the page serves harmless content, causing URL detonators to issue a clean verdict.

Q4: What forensic artifacts should SOC teams look for to hunt for Storm-2755 compromises?

SOC analysts and threat hunters should look for the following indicators in Microsoft Entra ID / Exchange logs:

• Graph API Activity: Unexpected queries against [graph.microsoft.com/v1.0/users](https://graph.microsoft.com/v1.0/users) filtering for terms like payroll, hr, or finance.
• Anomalous User Agents: Active sessions utilizing user-agent strings like Axios 1.7.9 or non-standard browser signatures coming from residential proxy IP ranges.
• Inbox Rule Creation: Newly created Exchange inbox rules that automatically mark emails containing keywords like "bank," "payroll," or "direct deposit" as read and move them to deleted or hidden folders.
• Authentication Errors: Initial failed login attempts producing ResultType 90014 (missing credential fields) originating from US mobile carrier networks.

Q5: How does StrongestLayer TRACE detect this campaign before delivery?

While traditional URL sandboxes get trapped by fingerprint cloaking gates (resulting in a "PARTIAL" verdict), StrongestLayer’s TRACE engine analyzes the intent genome of the message. TRACE identifies the high-risk combination of a voicemail portal pretext attempting to funnel an enterprise user into a Microsoft authentication workflow directly within the email body. By fusing this intent reasoning with sender signals and live redirect chain telemetry, TRACE reaches a confident DETECT verdict before the email reaches the user's inbox.

‍