Loading story…
A widespread phishing campaign is compromising Microsoft 365 accounts with adversary-in-the-middle login pages that capture session material even when MFA is enabled, then using those identities to target payroll, HR, finance, and administrative staff across healthcare, education, manufacturing, government, and professional services in the United States, Canada, and Europe. Arctic Wolf said the activity aligns technically and behaviorally with Microsoft-tracked Storm-2755 (also known as Payroll Pirates), with attackers maintaining access through rotating residential proxies and automated session activity roughly every eight hours while quietly collecting mailbox data tied to financial workflows.
Reporting also shows the intrusions can progress without additional device compromise, shifting instead into identity-plane lateral movement inside Entra ID and Microsoft 365. After an initial phish, attackers can use stolen session tokens to enumerate the tenant through Microsoft Graph, register a malicious Entra ID application, create a service principal, grant permissions such as Mail.Read and Mail.Send, and access other users’ mailboxes, including executives, before sending fraudulent messages through Graph API that pass SPF and DKIM checks. Defenders were urged to correlate cloud identity, Graph, sign-in, and email telemetry for signals including OfficeHome error 90014, anomalous Outlook sign-ins with Firefox user agents, repeated SessionID reuse across changing IPs and geographies, suspicious app registrations, credential additions to service principals, and unusual application access to user mailboxes.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Arctic Wolf observed hundreds of organizations across the United States, Canada, and Europe targeted by a widespread email campaign in July 2026. The operation used voicemail-themed lures and adversary-in-the-middle phishing pages to compromise Microsoft 365 accounts, including victims in healthcare, education, manufacturing, government, and professional services.
Detect described an attack path in Microsoft 365 and Entra ID where a phished user's session token is used to enumerate the tenant, register a malicious Entra application, create a service principal, and grant it permissions such as Mail.Read and Mail.Send. The article's example culminates in the service principal accessing the CFO's mailbox and sending a fraudulent wire-transfer reply through Microsoft Graph API.
Arctic Wolf reported that the campaign's technical and behavioral characteristics overlap with the Payroll Pirates cluster tracked by Microsoft as Storm-2755. The report highlighted durable detection signals including OfficeHome error 90014, anomalous Outlook sign-ins with Firefox user agents, SessionID reuse across changing IPs, and a distinctive MailItemsAccessed telemetry pattern.
Following account compromise, the actor used Microsoft Graph to identify payroll, HR, finance, and administrative users and then accessed messages related to payroll, invoices, payments, banking, benefits, and internal documents. In Defender XDR, this reconnaissance generated Suspicious Exchange Online Graph Reconnaissance Activity alerts, and successful Bind events confirmed message retrieval.
After successful authentication through the AiTM infrastructure, malicious OfficeHome sign-ins typically began within minutes and often recurred 11 to 24 hours later at roughly eight-hour intervals. Arctic Wolf said the actor reused the same SessionID across changing IPs, ASNs, and geographies, indicating centralized automation maintaining compromised sessions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcethehackernews.com
Open sourcemalware.news
Open sourcearcticwolf.com
Open sourcedetect.fyi
Open sourcesra.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft and other security researchers reported multiple campaigns in which attackers abused trusted cloud email environments to deliver phishing, spam, and business email compromise. In one Microsoft 365 intrusion set, attackers used credential stuffing against privileged accounts that lacked MFA, then registered malicious single-tenant OAuth applications with `Exchange.ManageAsApp` and elevated roles to persist in victim tenants. They modified Exchange Online inbound connectors and mail flow rules to relay scam email from legitimate organizational domains, promoting deceptive sweepstakes offers that harvested payment details for recurring subscriptions. Separately, Spamhaus identified more than 450 compromised Google Workspace education domains being used to send phishing and scam messages from real mailboxes, extending the same account-takeover model beyond Microsoft environments. Related reporting showed the same ecosystem of email abuse also supporting credential theft and financial fraud. Microsoft documented AiTM phishing operations using Evilginx2-style infrastructure to steal Office 365 passwords and session cookies, bypass MFA through cookie replay, and then access Outlook mailboxes, create inbox rules, and conduct payment fraud. Other campaigns used voicemail-themed HTML attachments, open redirect chains, Google reCAPTCHA gates, and spoofed Microsoft notifications such as Power BI alerts to harvest credentials at scale. Across the incidents, defenders were urged to enforce phishing-resistant MFA, disable legacy access, review forwarding rules and connected apps, monitor anomalous sign-ins and suspicious mailbox or transport-rule changes, and rapidly investigate compromised accounts being used as trusted sender infrastructure.
Aug 15, 2026
Microsoft said the financially motivated threat actor **Storm-2755** targeted Canadian employees in payroll diversion attacks by compromising Microsoft 365 accounts and changing salary payments to attacker-controlled bank accounts. The campaign used SEO poisoning and malvertising to lure victims to `bluegraintours[.]com`, where an adversary-in-the-middle phishing flow captured credentials, session cookies, and OAuth tokens, allowing the attackers to bypass MFA through token replay and gain persistent access to victim accounts. After entering compromised tenants, Storm-2755 searched for payroll and HR workflows, created inbox rules to hide messages about direct-deposit or banking changes, and in some cases manually accessed HR SaaS platforms such as **Workday** to alter payment details. Microsoft reported indicators including Entra error code `50199`, a user-agent shift to **Axios 1.7.9** with the same session ID, and recurring non-interactive **OfficeHome** sign-ins about every 30 minutes; the company said it assisted affected organizations, carried out tenant takedowns, and urged defenses including phishing-resistant MFA, token revocation, Conditional Access, continuous access evaluation, suspicious inbox-rule monitoring, and device compliance enforcement.
Jun 29, 2026
Attackers abused Microsoft’s legitimate authentication and Microsoft 365 infrastructure to run phishing and business email compromise campaigns without relying on fake login pages. Check Point observed more than 200 phishing emails sent to about 120 organizations across industries and countries, using Microsoft Planner-style notifications about HR, payroll, and benefits updates as lures. Victims were directed to a real `login.microsoftonline.com` authorization page and asked to approve a malicious OAuth application, after which Microsoft redirected the browser to an attacker-controlled AWS API Gateway endpoint that captured an authorization token for exchange into Microsoft account access. Researchers said the technique could give attackers broad access to Microsoft 365 data depending on granted permissions, including email, files, Teams chats, SharePoint, OneDrive, and calendar content, creating risks of credential theft, account takeover, data breaches, financial fraud, malware delivery, and BEC. High-value and privileged users, organizations handling sensitive data, tenants using Microsoft ADFS, and general Microsoft 365 users were identified as potential targets. Recommended defenses include enforcing MFA, auditing Microsoft 365 tenant and OAuth application settings, strengthening email and application security controls, applying sign-in risk policies, and training users to scrutinize consent prompts as well as phishing lures.
Aug 11, 2026