Payroll Pirates: Strange New Tides in Business Email Compromise
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
Arctic Wolf Labs is tracking an active AiTM phishing campaign (linked to Microsoft's Storm-2755 / 'Payroll Pirates' cluster) targeting Microsoft 365 accounts across healthcare, education, manufacturing, government, and other sectors in the US, Canada, and Europe. The campaign uses voicemail-themed lures with multi-stage redirect chains abusing Google Meet, Google Ads, and AWS S3 to route victims to AiTM proxies that intercept sessions even when MFA is enabled. After compromise, automated tooling maintains sessions at eight-hour intervals via rotating residential proxies, uses Microsoft Graph to enumerate finance and HR personnel, and collects payroll-related email. A distinctive cross-tenant mailbox collection pattern — 18 events across three tenants in 26 seconds — and a unique Client App ID / API ID pairing (5d661950... / c999ed3e...) serve as high-fidelity detection signals. The post provides detailed detection guidance covering Entra ID sign-in logs, Unified Audit Logs, and network/DNS telemetry, plus hardening recommendations including phishing-resistant MFA (FIDO2), Conditional Access, and Continuous Access Evaluation.
Table of contents
Key TakeawaysIntroductionTechnical DetailsConclusionDetection GuidanceRemediation and Hardening GuidanceAppendixQuestions this post answers
What detection signals identify the Storm-2755 Payroll Pirates AiTM campaign in Microsoft 365 audit logs?
Two high-fidelity indicators stand out. First, a MailItemsAccessed event pairing Client App ID 5d661950-3475-41cd-a2c3-d671a3162bc1 (Microsoft Outlook) with API ID c999ed3e-27ae-4cb3-b3a2-46b056af63d3 — a combination never observed in legitimate traffic. Second, Entra ID sign-in error code 90014 on the OfficeHome application, especially combined with implausible browser/OS pairs like Mobile Safari on Windows 10. Teams hunting BEC intrusions in Microsoft 365 environments track emerging indicator combinations like these on daily.dev.
How does the Storm-2755 AiTM phishing kit bypass MFA on Microsoft 365 accounts?
The kit operates a reverse proxy that relays the genuine Microsoft OAuth authentication flow in real time, including the MFA challenge, rather than serving a static credential-harvesting page. The victim completes real MFA against Microsoft, but the proxy intercepts the resulting session token at the callback before redirecting the victim to the legitimate Office 365 site — no MFA bypass is needed because the session material is stolen post-authentication. Developers and admins evaluating phishing-resistant MFA options for Microsoft 365 find relevant threat context on daily.dev.
What hardening steps prevent AiTM session-hijacking attacks against Microsoft 365 even when MFA is enabled?
Three controls directly counter AiTM session relay: deploy phishing-resistant MFA (FIDO2 security keys, Windows Hello for Business, or certificate-based authentication), which binds authentication to the legitimate service; enforce Conditional Access policies requiring compliant or Entra hybrid-joined devices to block stolen-session replay from unmanaged infrastructure; and enable Continuous Access Evaluation (CAE) for near-real-time token revocation when risk conditions change. Engineers hardening Microsoft 365 against session-hijacking stay current on new attack techniques and mitigations on daily.dev.