Microsoft Reports Storm-2755 Payroll-Theft Attacks on Canadian Employees
Summary
Microsoft says financially motivated group Storm-2755 is hijacking Canadian employees’ accounts to divert salary payments, using AiTM phishing to steal session cookies and OAuth tokens, hide HR messages, and alter direct-deposit details.
Key points
- Microsoft attributes attacks targeting Canadian employees’ payroll accounts to financially motivated group Storm-2755.
- The attackers use malicious Microsoft 365 sign-in pages, promoted through malvertising or SEO poisoning, to capture authentication tokens and session cookies.
- AiTM token replay can let attackers access Microsoft services without re-entering credentials or MFA.
- After account access, attackers create inbox rules to hide HR messages and may trick HR staff into changing payment details or update Workday directly.
- Microsoft recommends blocking legacy authentication and deploying phishing-resistant MFA.
- For suspected compromise, Microsoft advises revoking tokens and sessions, removing malicious inbox rules, and resetting affected credentials and MFA methods.
Article Details
- Event Type
- Payroll-account takeover and salary-diversion attacks using adversary-in-the-middle phishing
- Impact
- Storm-2755 reportedly hijacked Canadian employees’ accounts, stole session cookies and OAuth tokens to bypass MFA, concealed HR messages with inbox rules, and changed direct-deposit details to divert salary payments. The article also reports that a separate Storm-2657 campaign targeted U.S. university employees’ payroll accounts; Microsoft disrupted that campaign.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | bluegraintours[.]com | Domain reported as hosting malicious Microsoft 365 sign-in pages used to steal authentication tokens and session cookies. |
MITRE ATT&CK
T1528 · Steal Application Access TokenThe attackers reportedly captured OAuth access tokens issued during authentication and reused them to access Microsoft services.T1539 · Steal Web Session CookieThe attackers reportedly stole and replayed session cookies to access victims’ accounts.T1557 · Adversary-in-the-MiddleStorm-2755 reportedly used adversary-in-the-middle attacks to capture authentication tokens and session cookies.
Threat Actors
Storm-2657The article reports that this cybercrime group targeted U.S. university employees in a separate payroll campaign and that Microsoft disrupted the campaign.Storm-2755Microsoft tracks this financially motivated group, which the article reports hijacked Canadian employees’ payroll accounts and diverted salary payments.
Vendors
Products
Exchange OnlineâIn these attacks, Storm-2657 breached the targets’ accounts via phishing emails and stole MFA codes using AITM tactics, which allowed the threat actors to compromise the victims’ Exchange Online accounts.Microsoft 365 Apps for EnterpriseThey deploy malicious Microsoft 365 signâin pages and AiTM frameworks to capture session cookies and OAuth tokens—bypassing legacy MFA—to access accounts, hide HR messages, and change direct deposit details (includingWorkdaylegacy MFA—to access accounts, hide HR messages, and change direct deposit details (including via Workday).