What Happened
Cybersecurity researchers detailed an active, widespread adversary-in-the-middle phishing campaign targeting Microsoft 365 accounts at organisations across the United States, Canada, and Europe. Microsoft tracks the activity under the moniker Storm-2755, with tactical overlaps documented under the label Payroll Pirate. The campaign’s lures arrive by email and route victims through a six-stage redirect chain threading Google Meet, Google Ads infrastructure, and Amazon S3, allowing the phishing links to pass through reputation-based email filters without detection.
Once a victim clicks through, they reach a proxy-based fake Microsoft login page. The attacker’s infrastructure intercepts the completed authentication in real time, capturing the victim’s session token — including any MFA token — before forwarding the login to the legitimate Microsoft service. The victim sees a successful sign-in. The attacker now holds a live session token good for roughly eight hours, maintained by automated activity at regular intervals. Confirmed targets include organisations in healthcare, education, manufacturing, government, and professional services. The campaign’s focus post-intrusion is clear: attackers search mailboxes for payroll and finance-related email to support follow-on business email compromise attacks.
Why This Matters for Canadian Organizations
Canada is explicitly named as one of the primary target regions, alongside the United States and Europe. This is not theoretical exposure — Canadian organisations in healthcare, government, and financial services are confirmed to have been targeted in July 2026 alone. The attack defeats standard MFA completely. Token theft via adversary-in-the-middle phishing makes SMS, authenticator apps, and push notifications irrelevant, because the attacker captures the session after MFA is satisfied, not before. No credential reset, no MFA re-enrollment, no password change will revoke a stolen session token unless the session itself is explicitly terminated.
From a regulatory standpoint, a successful intrusion exposing payroll data or employee financial information triggers breach notification obligations under PIPEDA and, for federally regulated financial institutions, OSFI’s B-13 incident reporting requirements. The payroll and finance focus also means organisations face a double risk: direct financial loss through fraudulent wire transfers, and regulatory liability for personal data exposure.
What to Do
Organisations running Microsoft 365 should take four immediate steps. First, implement phishing-resistant MFA — FIDO2 hardware keys or Windows Hello for Business — for all users with access to financial or payroll systems. Standard TOTP and push-based MFA do not stop AitM attacks. Second, configure Conditional Access Policies to block device code authentication flows and enforce compliant device requirements for M365 sign-ins. Third, review Microsoft Entra sign-in logs for sessions authenticated from residential proxy IP ranges or showing session persistence at regular eight-hour intervals. Fourth, set session token lifetimes to the shortest duration operations allow and enable continuous access evaluation. Security teams should add Storm-2755 indicators of compromise to SIEM detection rules and treat any unexpected payroll or finance mailbox access as a high-priority alert.
Source: The Hacker News
