Organizations relying on Microsoft 365 for daily collaboration are facing a sophisticated wave of credential theft that bypasses traditional defenses through adversary‑in‑the‑middle tactics. Unlike classic phishing that harvests passwords on a fake login page, this campaign inserts a transparent proxy between the user and the legitimate Microsoft authentication flow, silently capturing both credentials and the second‑factor codes that many consider a safety net. The attackers’ ultimate goal is not merely to hijack an inbox but to locate the individuals who manage payroll, benefits, and financial reporting, then siphon off any correspondence that could reveal banking details, invoice schedules, or internal compensation structures. By focusing on finance‑related mailboxes, the threat actors position themselves to redirect salary payments, manipulate vendor invoices, or gather intelligence for later business‑email‑compromise schemes. The campaign’s reach spans multiple industries, indicating that any organization with a centralized HR or accounting function is a potential target. Understanding the mechanics of this approach is essential for security teams that wish to update detection rules, refine user training, and reinforce identity protections before the next wave of attacks arrives. Security leaders should treat this as a wake‑up call to revisit their zero‑trust assumptions, especially around session persistence and geographic login anomalies.
The campaign’s reliance on residential proxy networks marks a notable evolution in how threat actors mask malicious sign‑ins as ordinary consumer traffic. By routing authentication requests through IP addresses assigned to real home internet connections, the attackers blend in with legitimate browsing activity, making it far harder for reputation‑based filters or impossible‑travel alerts to raise an alarm. Each compromised session is kept alive through automated refreshes that occur roughly every eight hours, a cadence chosen to match typical token lifetimes while avoiding the bursts of activity that might trigger brute‑force detection. This low‑and‑slow approach also reduces the volume of logs that security analysts need to sift through, allowing the intruders to operate under the radar for days or even weeks. Importantly, the proxies are selected based on the victim’s geographic location, a detail gleaned from an early‑stage geolocation query that stores a country code in a cookie. This geo‑matching ensures that subsequent logins appear to originate from the same city or region as the legitimate user, further frustrating attempts to detect impossible‑travel patterns. For defenders, the takeaway is clear: reliance on IP reputation alone is insufficient; organizations must supplement it with behavioral analytics that look at device fingerprints, session characteristics, and anomalies in authentication timing.
The observed victim set spans a broad cross‑section of the economy, with healthcare providers, educational institutions, manufacturing plants, government agencies, and professional‑services firms all appearing in the threat actor’s telemetry. This diversity underscores the attackers’ opportunistic mindset: any organization that maintains a centralized payroll or human‑resources function presents a lucrative target, regardless of industry‑specific regulations or typical threat profiles. Geographically, the campaign has been concentrated in the United States, Canada, and various European nations, reflecting both the prevalence of Microsoft 365 deployments in those regions and the ease of acquiring residential proxy exit nodes that match local ISP ranges. In sectors such as healthcare, where payroll data often intertwines with sensitive patient‑billing information, a breach could lead to dual‑impact scenarios involving both financial fraud and privacy violations. Educational campuses, meanwhile, may see research grant payments diverted, while manufacturers could discover that vendor‑payment instructions have been altered. The cross‑industry nature of the activity means that defenders cannot rely on sector‑specific threat intelligence alone; they must adopt a horizontal view of identity risk and ensure that protective measures are uniformly applied across all business units that handle financial workflows.
Analysts have linked this latest wave of activity to the broader Payroll Pirate phenomenon that Microsoft tracks under the designations Storm‑2755 and its predecessor Storm‑2657. The Payroll Pirate label refers to a financially motivated cluster whose hallmark is the compromise of employee accounts in order to divert salary deposits to attacker‑controlled bank accounts. While earlier incarnations of the scheme relied heavily on direct credential harvesting and immediate fraudulent transactions, the current iteration demonstrates a more patient posture: after gaining access, the actors spend time enumerating the tenant’s user base to pinpoint individuals whose job titles or group memberships indicate involvement in payroll, benefits, or financial administration. Only then do they begin to exfiltrate relevant email threads, searching for details such as bank routing numbers, upcoming payroll runs, or internal approval chains that could be leveraged for a later funds‑transfer fraud. The temporal gap between initial intrusion and the start of data collection—often measured in hours—helps the attackers avoid raising immediate suspicion, and the use of automated session maintenance keeps the foothold alive without the noisy behaviors that typically betray a business‑email‑compromise attempt.
According to Arctic Wolf Labs, the phishing lure reached hundreds of distinct organizations during the most recent month of observation, with a non‑trivial fraction of those targets resulting in confirmed account takeover. The breadth of the victim set illustrates that the campaign is not limited to a handful of high‑profile targets but instead operates as a net‑casting operation that sweeps through any domain where a voicemail‑themed lure can find a willing clicker. Successful intrusions have been documented in environments ranging from small municipal offices with modest IT teams to large multinational enterprises that maintain complex hybrid identity infrastructures. This wide‑scale impact suggests that the threat actors have invested in automation and infrastructure that allows them to scale their efforts quickly, leveraging cheap residential proxy pools and readily available cloud storage services to host the intermediate redirectors. For security leaders, the implication is clear: even organizations that consider themselves below the radar of nation‑state or financially motivated groups must assume that they are within the campaign’s reach and should therefore validate that their email security gateways, multi‑factor authentication enforcement, and anomalous‑login detection mechanisms are functioning as intended.
The infection chain begins with an email that masquerades as a missed voicemail notification, a lure that exploits the natural curiosity of recipients who want to know who tried to reach them and what the message contained. Embedded within the message is a URL that appears to point to a Google Meet meeting link, but the actual destination is a series of redirects that first pass through Google’s outbound‑link tracking infrastructure, then encounter a Campaign Manager dynamic click tracker, and finally land on an HTML object hosted in an Amazon S3 bucket. Each hop in this chain is deliberately chosen because it leverages a service that enjoys a strong reputation in most URL‑filtering and safe‑browsing databases, thereby allowing the malicious payload to slip past perimeter defenses that would otherwise block a direct link to a known phishing domain. The use of legitimate platforms also confers a psychological advantage: recipients are less likely to suspect foul play when they see familiar domains such as google.com or amazonaws.com in the address bar, even though the content being served is under the attacker’s full control. By the time the victim arrives at the final landing page, they have already been fingerprinted and are about to be presented with a counterfeit Microsoft sign‑in form that silently forwards their credentials to the adversary.
Beyond the surface‑level redirectors, the campaign employs a series of client‑side scripts that gather a rich set of attributes from the victim’s browser and operating system. The JavaScript payload collects data points such as the user‑agent string, screen resolution, color depth, installed fonts, WebGL vendor, and whether automation tools like Selenium or Puppeteer are present. This fingerprint is bundled into an HTTP POST request sent to a PHP endpoint controlled by the attackers, where it is logged alongside a timestamp and the IP address of the requesting host. The script then forwards the browser to the proxied Microsoft OAuth authorization endpoint, preserving the original state and nonce parameters so that the authentication flow appears legitimate to both the user and the identity provider. In parallel, the code queries an external geolocation service—api.country[.]is—to retrieve a two‑letter country code, which is stored in a cookie named rcfh_country with a seven‑day expiration. This cookie later informs the attackers’ choice of residential proxy exit node, ensuring that subsequent authentication attempts appear to originate from the same geographic region as the victim’s legitimate login attempts, a tactic that directly counters impossible‑travel and geolocation‑based anomaly detectors.
Once the initial token is obtained, the threat actors shift to a maintenance phase that relies on rotating residential proxy addresses to keep the session alive without raising suspicion. Automated scripts refresh the access token roughly every eight hours, a interval that aligns with the typical lifetime of a Microsoft 365 refresh token while staying low enough to avoid triggering alerts based on rapid‑fire authentication attempts. Each refresh originates from a different residential IP address, yet the SessionID remains constant, a clear indicator that a centralized controller is issuing the requests and simply swapping out the underlying network exit point. Intriguingly, the logs often show implausible client signatures—such as mobile versions of Safari or Chrome claiming to run on Windows 10—or user agents that identify the request as coming from Firefox versions that do not correspond to any official release. These inconsistencies are artifacts of the proxy chain and the scripting language used to perform the requests (sometimes plain Python Requests), and they serve as a useful hunting clue for defenders who correlate user‑agent anomalies with session‑ID continuity. The combination of steady session persistence, geographic proxy matching, and subtle client‑irregularities creates a low‑signature foothold that can persist for weeks before being noticed.
With a valid session in hand, the attackers invoke the Microsoft Graph API to map the organization’s user landscape, focusing on accounts that exhibit attributes associated with payroll, human resources, finance, or administrative functions. API calls retrieve user display names, department names, job titles, and group memberships, allowing the threat actors to build a targeted list of mailboxes that are most likely to contain salary‑related correspondence, invoice approvals, or benefits‑enrollment documents. Once the list is compiled, the script iterates through each mailbox, downloading message headers and, in many cases, the full body of emails that contain keywords such as “payroll,” “invoice,” “wire transfer,” or “bank account.” Notably, the attackers refrain from modifying the mailbox itself: they do not create inbox rules, change passwords, register new devices, or alter multi‑factor authentication methods. This restraint minimizes the telemetry that would typically alert security teams to an account compromise, such as sudden changes in authentication patterns or the appearance of unfamiliar client applications. By limiting their actions to passive enumeration and data exfiltration, the threat actors extend the dwell time of their intrusion and reduce the probability of early detection.
In the majority of investigated incidents, the post‑compromise behavior remained confined to session maintenance, reconnaissance, and mailbox harvesting, with no observable lateral movement, credential theft beyond the initial takeover, or attempts to send fraudulent messages from the compromised account. This deliberate avoidance of typical business‑email‑compromise tactics—such as forwarding rules that send copies of incoming mail to an external address, or the creation of send‑as permissions—helps the attackers stay beneath the threshold of many anomaly‑detection engines that look for sudden spikes in outbound email or changes to mailbox configuration. However, a small subset of cases did reveal hands‑on‑keyboard intervention, wherein the threat actor logged in directly to craft inbox rules that automatically moved specific messages to the Deleted Items folder and marked them as read. These selective manipulations suggest that a human operator may be overseeing high‑value targets, deciding which pieces of intelligence to conceal while leaving the bulk of the mailbox untouched for automated scraping. The dichotomy between fully automated processes and occasional manual tweaks points to a hybrid operational model: a scalable infrastructure handles the bulk of the work, while a smaller team of operators steps in when judgment calls are required, such as determining whether a particular email contains actionable banking details.
Defenders seeking to blunt the effectiveness of this campaign should adopt a layered strategy that addresses both the initial lure and the subsequent abuse of legitimate services. First, email security gateways need to be tuned to detect voicemail‑themed lures that embed redirect chains through trusted domains; URL‑rewriting and sandbox analysis can reveal the multi‑hop nature of the threat before it reaches the user’s inbox. Second, conditional access policies in Microsoft Entra ID (formerly Azure AD) should enforce phishing‑resistant multi‑factor authentication, such as FIDO2 security keys or certificate‑based authentication, thereby neutralizing the value of captured passwords and one‑time codes. Third, continuous monitoring of sign‑in logs for patterns such as stable SessionIDs paired with rotating IP addresses, improbable user‑agent strings, or authentication originating from residential ASNs can trigger early alerts. Fourth, applying geographic login restrictions or impossible‑travel detectors that incorporate cookie‑based geolocation data may catch the attackers’ attempts to match proxy locations to the victim’s region. Finally, user awareness training should emphasize the dangers of unsolicited voicemail notifications and encourage employees to verify the legitimacy of any unexpected communication through a separate channel before clicking any links.
To translate these recommendations into concrete steps, organizations should begin by reviewing their current conditional access baseline and ensuring that block legacy authentication protocols is enabled, as legacy flows do not support modern MFA and are frequently abused in proxy‑based attacks. Next, implement sign‑in risk policies that automatically require multi‑factor authentication or force a password change when a sign‑in event is flagged as medium or high risk, especially if the session characteristics show the telltale signs of residential proxy usage. Additionally, enable mailbox audit logging and configure alerts for atypical inbox rule creation, even if the current campaign has not heavily relied on this tactic, because defensive posture must anticipate evolution. Finally, run regular tabletop exercises that simulate a voicemail‑phishing leading to an AitM compromise, allowing incident‑response teams to practice token revocation, session termination, and forensic collection of proxy‑related logs. By combining technical controls, vigilant monitoring, and informed user behavior, enterprises can reduce the dwell time of this stealthy threat and protect the payroll and financial communications that remain a prime target for financially motivated adversaries.