Microsoft 365 AitM Phishing Hijacks Accounts to Collect Payroll and Finance Emails

A widespread phishing campaign, leveraging adversary-in-the-middle (AitM) techniques and residential proxies, is targeting organizations across various sectors in the U.S., Canada, and Europe. The campaign, linked to the broader Payroll Pirate threat cluster (Storm-2755), uses sophisticated redirection chains and fingerprinting to compromise Microsoft 365 accounts and steal payroll and finance-related emails. Threat actors are carefully avoiding common business email compromise (BEC) behaviors to evade detection, but some instances involve targeted rule creation for account manipulation.