Microsoft Details Storm-2755 AiTM Campaign Targeting Canadian Payroll
Summary
Microsoft details Storm-2755’s Canada-focused campaign using SEO poisoning and malvertising to steal Microsoft 365 credentials and tokens, hijack sessions, and target payroll. Microsoft reports one payment was redirected through Workday.
Key points
- SEO poisoning and malvertising directed Canadian users searching for Microsoft 365 to a fake sign-in page at bluegraintours[.]com.
- Storm-2755 used AiTM to capture session cookies and OAuth tokens. Microsoft observed a shift to axios/1.7.9 with the same session ID, following Entra error 50199.
- Non-interactive OfficeHome sign-ins occurred about every 30 minutes as stolen sessions were maintained; some accounts also saw password and MFA changes.
- Compromised accounts were searched for payroll and HR information. Emails about direct deposits targeted HR or finance staff, while inbox rules hid messages containing terms such as “bank.”
- Microsoft reports one case in which the actor used a stolen session to change banking details in Workday, redirecting a payroll payment.
- Microsoft recommends revoking sessions and tokens, removing malicious inbox rules, using phishing-resistant MFA and Conditional Access, and monitoring for unusual sign-ins.
- The article includes hunting queries for suspicious inbox rules and Workday payment-account changes.
Article Details
- Attack Vectors
- SEO poisoning and malvertising positioned an actor-controlled domain in search results for Microsoft 365 queries, directing Canadian users to a fake sign-in page.
- An adversary-in-the-middle attack proxied authentication and captured credentials, session cookies, and OAuth tokens; replayed tokens enabled access without repeated authentication and bypassed non-phishing-resistant MFA.
- Compromised accounts were searched for payroll and HR information, and social-engineering emails with the subject “Question about direct deposit” targeted HR or finance staff.
- Inbox rules moved messages containing terms such as “direct deposit” or “bank” to hidden folders, suppressing alerts from HR.
- The actor used stolen sessions to access Workday and change banking details, redirecting a payroll payment in one reported case.
- Defensive Notes
- Immediately revoke compromised tokens and sessions, remove malicious inbox rules, and reset affected credentials and MFA methods.
- Implement phishing-resistant MFA, Conditional Access policies, and controls that block legacy authentication; use session-lifetime policies to require reauthentication.
- Use continuous access evaluation to help revoke access when risk conditions change, credentials are reset, or policies are enforced.
- Monitor for anomalous user agents such as Axios, suspicious sign-ins and token replay patterns, and unusual inbox-rule creation; audit OAuth applications.
- Use Microsoft Defender detections and SIEM monitoring to investigate anomalous activity, and alert on Workday payment-election changes.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxp[:]//bluegraintours[.]com | Actor-controlled malicious landing page used in SEO poisoning and malvertising to steal credentials and tokens. |
MITRE ATT&CK
T1078 · Valid AccountsStorm-2755 replayed stolen session tokens to access services as compromised users.T1087 · Account DiscoveryDuring compromised sessions, searches for payroll, HR, finance, and account-related terms helped locate relevant internal resources.T1539 · Steal Web Session CookieThe AiTM flow captured session cookies and OAuth tokens for session hijacking.T1557 · Adversary-in-the-MiddleThe campaign proxied the authentication flow in real time to capture session data.T1564.008 · Email Hiding RulesInbox rules moved messages containing “direct deposit” or “bank” to hidden folders to conceal HR correspondence.T1566 · PhishingSEO poisoning and malvertising directed users to a fake Microsoft 365 sign-in page to obtain credentials.
CVE
Threat Actors
Vendors
MicrosoftMicrosoft describes a Canadaâfocused AiTM campaign by Storm-2755 that used SEO poisoning and malvertising (hxxp://bluegraintours[.]com) to serve fake Microsoft 365 sign-in pages and steal tokens/credentials.WorkdayObserved impact included a confirmed payroll fraud where Storm-2755 used stolen sessions and Workday access to change banking details and redirect a payroll payment; Microsoft recommends revoking tokens, implementing
Products
Axiosauthentication flow, capturing session cookies and OAuth tokens and replaying them (user-agent shifted to axios/1.7.9 while session ID remained unchanged) to bypass nonâphishingâresistant MFA.Microsoft 365 Apps for EnterpriseMicrosoft describes a Canadaâfocused AiTM campaign by Storm-2755 that used SEO poisoning and malvertising (hxxp://bluegraintours[.]com) to serve fake Microsoft 365 sign-in pages and steal tokens/credentials.Microsoft Defender XDRMicrosoft Defender XDR coordinates detection, prevention, investigation, and response across endpoints, identities, email, apps to provide integrated protection against attacks like the threat discussed in this blog.Microsoft Entra IDMicrosoft Entra ID ProtectionMicrosoft IntuneSecure organizational resources through Microsoft Intune compliance policies: When integrated with Microsoft Entra Conditional Access policies, Intune offers an added layer of protection based on a devices currentMicrosoft SentinelMicrosoft Sentinel customers can use the TI Mapping analytics (a series of analytics all prefixed with ‘TI map’) to automatically match the malicious domain indicators mentioned in this blog post with data in theirWorkdayObserved impact included a confirmed payroll fraud where Storm-2755 used stolen sessions and Workday access to change banking details and redirect a payroll payment; Microsoft recommends revoking tokens, implementing