AitM Phishing Targets M365 Payroll Data

Executive Summary

A large-scale and financially motivated adversary-in-the-middle (AitM) phishing campaign is actively targeting Microsoft 365 accounts across hundreds of organizations. The attack is attributed to threat clusters tracked as Storm-2657 and Storm-2755 (also known as Payroll Pirates). The campaign begins with voicemail-themed phishing emails that lure victims through a multi-stage redirection chain, ultimately landing them on a sophisticated AitM phishing site. This site acts as a proxy, capturing the user's credentials and, critically, their multi-factor authentication (MFA) session token in real-time. After hijacking the account, the attackers use residential proxies to blend in with normal traffic and automated tooling to maintain the session. Their primary goal is to perform reconnaissance within the victim's mailbox, searching for and exfiltrating sensitive emails and documents related to payroll, invoices, and banking, with the ultimate aim of payroll diversion.

Threat Overview

This campaign demonstrates a clear, financially motivated objective executed with sophisticated tools and techniques designed to bypass modern security controls.

Attack Chain

1. Initial Lure: The attack begins with a phishing email, often disguised as a voicemail notification.
2. Redirection Chain: The link in the email does not lead directly to the phishing site. Instead, it initiates a six-stage redirection chain that leverages legitimate services like Google Meet and Amazon S3 to evade email security filters.
3. AitM Phishing: The final destination is an AitM phishing page that perfectly mimics the Microsoft login portal. This page acts as a reverse proxy between the victim and Microsoft.
4. Credential and Session Theft: The AitM proxy captures the user's username, password, and the MFA session cookie after the user successfully authenticates.
5. Evasion: The attackers use residential proxies for their post-compromise activities, making their malicious sign-ins difficult to distinguish from legitimate remote user traffic.
6. Automated Persistence: Automated tools are used to maintain the hijacked session, refreshing it every eight hours to avoid expiration.
7. Reconnaissance and Exfiltration: The attackers use the Microsoft Graph API to search the compromised mailbox for keywords like "payroll," "invoice," "payment," and "banking." They also enumerate users to identify others in finance and HR departments for further targeting.

Technical Analysis

The combination of AitM phishing, residential proxy usage, and API-based reconnaissance makes this a highly effective campaign.

• AitM Phishing: This is the key technique for bypassing MFA. By proxying the entire login flow, the attackers can steal the session cookie, which is the 'key' that proves the user has already completed an MFA-protected login.
• Residential Proxies: Using IP addresses from legitimate residential ISPs allows the attackers' traffic to blend in. Blocking an entire residential IP range is not feasible for most organizations, as it would block legitimate customers or remote employees.
• Microsoft Graph API Abuse: Instead of manually browsing the mailbox, the attackers use the Graph API to programmatically and rapidly search for high-value information. This is faster, stealthier, and less likely to be noticed by the user.

MITRE ATT&CK Mapping

• T1566.002 - Spearphishing Link: The initial email with the malicious link.
• T1110.004 - Credential Stuffing: The use of an AitM proxy to defeat MFA and steal session tokens.
• T1539 - Steal Web Session Cookie: The primary goal of the AitM phishing page.
• T1090.002 - External Proxy: Use of residential proxies to obscure the origin of the attack.
• T1114.002 - Remote Email Collection: Using the Graph API to search for and exfiltrate emails.
• T1078.004 - Cloud Accounts: The attackers use the compromised cloud account to conduct their operations.

Impact Assessment

The campaign has targeted hundreds of organizations across healthcare, education, manufacturing, and government, primarily in the U.S., Canada, and Europe.

• Payroll Diversion: The ultimate goal of the "Payroll Pirates" is to use the information gathered to socially engineer HR/payroll staff into changing an employee's direct deposit information, diverting their salary to an attacker-controlled account.
• Business Email Compromise (BEC): The stolen information about invoices and payments can be used to launch sophisticated BEC attacks, tricking the company or its clients into sending payments to fraudulent accounts.
• Data Breach: The exfiltration of emails containing sensitive financial and employee PII constitutes a data breach, with associated regulatory and notification requirements.

IOCs — Directly from Articles

No specific IOCs were provided in the source articles.

Cyber Observables — Hunting Hints

Detection & Response

Detection

1. Enhanced Email Filtering: Use email security gateways that can perform sandboxing and analysis of URLs to detect the multi-stage redirection chain.
2. Entra ID Identity Protection: Enable and monitor alerts from Entra ID Identity Protection, which can detect risky sign-ins, impossible travel, and other anomalies associated with account takeover.
3. Audit Log Monitoring: Create specific detection rules in your SIEM to alert on suspicious Graph API usage, such as an application enumerating all users or performing keyword searches across many mailboxes. This is an application of D3FEND's Domestic User Activity Analysis.

Response

• Upon detecting a compromised account, immediately revoke all session tokens for the user, reset their password, and investigate all activity from the time of compromise. Check for changes to mailbox rules (e.g., forwarding rules) and MFA settings.

Mitigation

1. Phishing-Resistant MFA: As with other AitM campaigns, the most effective technical mitigation is the adoption of phishing-resistant MFA, such as FIDO2 security keys. This breaks the AitM attack chain.
2. User Training: Train users to be suspicious of voicemail-themed emails and to verify the authenticity of any login prompts, especially those that follow a series of redirects.
3. Conditional Access Policies: Implement Conditional Access policies that block sign-ins from legacy authentication protocols and require logins to come from trusted locations or compliant devices.
4. Limit API Permissions: Review permissions granted to third-party applications and scripts that use the Graph API. Enforce the principle of least privilege to limit what an attacker can do even if they gain control of an application.