Microsoft 365 AitM Phishing Campaign Hijacks Payroll Accounts
Arctic Wolf Labs has revealed a widespread adversary-in-the-middle (AitM) phishing campaign targeting Microsoft 365 accounts at organizations across healthcare, education, manufacturing, government, and professional services sectors in the U.S., Canada, and Europe. The financially motivated operation, which mirrors the "Payroll Pirate" activity tracked by Microsoft as Storm-2755 and Storm-2657, focuses on hijacking employee accounts tied to payroll and finance workflows in order to reroute salary payments and harvest sensitive correspondence. Hundreds of organizations were targeted last month, with researchers confirming successful intrusions across a broad range of victim environments.
The attack chain begins with voicemail-themed phishing emails that lure victims into a six-stage redirection sequence built on trusted services such as Google Meet, Google's outbound-link infrastructure, Google Ads Campaign Manager click trackers, and an HTML object hosted inside an Amazon AWS S3 bucket. From there, the victim is forwarded to the attackers' AitM phishing infrastructure, which transparently proxies the legitimate Microsoft OAuth authentication flow while capturing credentials and one-time MFA codes in real time. Sessions are kept alive through automated sign-ins over residential proxies at roughly eight-hour intervals, making malicious activity appear as ordinary consumer traffic.
On the phishing landing page, JavaScript performs detailed browser fingerprinting, harvesting attributes including the user agent, screen and window dimensions, browser language, time zone offset, WebDriver status, WebGL vendor, and available browser APIs. The payload is packaged and exfiltrated to a PHP endpoint via HTTP POST, while a separate call to the geolocation service api.country[.]is stores the visitor's country code in an "rcfh_country" cookie with a seven-day expiration. Because residential IP space is used to mask the attacker infrastructure, defenders can validate suspicious egress IPs against a VPN and proxy detection tool to spot anomalous authentication traffic.
Once inside, the threat actor abuses the compromised mailbox to map out finance and payroll personnel, silently read and forward messages, and prepare fraudulent payment redirect instructions. Users concerned about credential exposure should run their work email through an email breach checker and rotate any reused passwords, prioritizing phishing-resistant authentication such as FIDO2 hardware keys to break the AitM relay chain.