Full Report
Cybersecurity researchers have called attention to an active "widespread email-driven phishing campaign" that employs adversary-in-the-middle (AitM) techniques to take control of Microsoft 365 accounts with an aim to identify key personnel involved in financial workflows and gather related email. "The campaign uses residential proxies to disguise malicious sign-ins as ordinary consumer traffic,
Analysis Summary
# Tool/Technique: AitM Phishing & Session Hijacking (Storm-2755 / Payroll Pirates)
## Overview
This technique involves Adversary-in-the-Middle (AitM) phishing attacks designed to bypass Multi-Factor Authentication (MFA). By proxying the legitimate authentication process, attackers capture session cookies, allowing them to hijack Microsoft 365 accounts. The primary goal is financial fraud, specifically targeting payroll and financial personnel to intercept or reroute funds.
## Technical Details
- **Type**: Technique / Phishing Campaign
- **Platform**: Microsoft 365 (SaaS), Windows, macOS, Mobile
- **Capabilities**: MFA bypass, session hijacking, automated email collection, residential proxy usage for geo-matching.
- **First Seen**: Documented variants appearing as early as early 2025; recent widespread activity reported August 2026.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0006 - Credential Access]**
- [T1557 - Adversary-in-the-Middle]
- [T1111 - Two-Factor Authentication Evasion]
- **[TA0007 - Discovery]**
- [T1114.002 - Email Collection: Remote Email Services]
- **[TA0005 - Defense Evasion]**
- [T1562.009 - Impair Defenses: Safe Browsing Allowlist Bypass] (Use of trusted domains like Google/S3)
- [T1090.005 - Proxy: Residential Proxies]
## Functionality
### Core Capabilities
- **Redirection Chain**: Utilizes a six-stage chain (Google Meet, Google Ads, Amazon S3) to bypass reputation-based email filters.
- **MFA Evasion**: Proxies the login in real-time, capturing the session token so the attacker does not need the victim's actual password for subsequent access.
- **Browser Fingerprinting**: JavaScript-based collection of OS, browser, screen resolution, and WebDriver status to ensure the victim is a real user and not a sandbox.
### Advanced Features
- **Residential Proxy Matching**: Uses geolocation APIs to route malicious sign-ins through exit nodes in the victim’s specific country/region to evade "unusual login" alerts.
- **Automated Persistence**: Compromised sessions are refreshed at approximately eight-hour intervals using automated Python or Firefox-based scripts to maintain long-term access.
## Indicators of Compromise
- **File Hashes**: N/A (Web-based attack)
- **Network Indicators**:
- `api[.]country[.]is` (Used for victim geolocation)
- `rcfh_country` (Cookie name used by the phishing kit)
- Amazon S3 bucket URLs containing HTML redirectors.
- Google dynamic click trackers (`/ddm/clk`).
- **Behavioral Indicators**:
- Sign-ins with "implausible" combinations (e.g., Mobile Safari reported on Windows 10).
- Recurring sign-ins using the same SessionID but rotating IP addresses and ASNs.
- Use of Python Requests or non-standard Firefox user agents for M365 access.
## Associated Threat Actors
- **Storm-2755** (Microsoft designation)
- **Storm-2657**
- **Payroll Pirates** (Activity cluster)
## Detection Methods
- **Behavioral Detection**: Monitor for Microsoft Entra ID (formerly Azure AD) logs showing successful logins where the User Agent changes mid-session or does not match the initial login device.
- **Anomaly Detection**: Flag sessions where the IP address changes geographical regions or ASNs within a short timeframe while maintaining the same Session ID.
- **Audit Logs**: Search for suspicious mailbox rules created immediately after a successful login from a residential proxy.
## Mitigation Strategies
- **FIDO2 Security Keys**: Implement hardware-based, phishing-resistant MFA (WebAuthn) which is not susceptible to AitM proxying.
- **Conditional Access**: Restrict access to known, compliant, or hybrid-joined devices.
- **Continuous Access Evaluation (CAE)**: Enable Microsoft 365 CAE to revoke sessions immediately upon detection of high-risk events.
- **Email Security**: Block or flag emails containing multi-stage redirects through S3 or Google click-trackers.
## Related Tools/Techniques
- **Evilginx2 / Muraena**: Frameworks commonly used to automate AitM phishing.
- **BEC (Business Email Compromise)**: The broader category of financial fraud this activity supports.