Full Report
The attack begins with phishing emails impersonating voicemail notifications that direct victims through a multi-stage redirect chain abusing legitimate services, including Google Meet, Google Ads infrastructure, and Amazon S3, before ultimately reaching an attacker-controlled...
Analysis Summary
# Incident Report: Payroll Pirates Phishing Campaign
## Executive Summary
A sophisticated Adversary-in-the-Middle (AiTM) phishing campaign, dubbed "Payroll Pirates," targeted Microsoft 365 environments by abusing legitimate cloud infrastructure to bypass Multi-Factor Authentication (MFA). Attackers utilized session token theft and residential proxies to maintain stealthy access, focusing on exfiltrating sensitive financial and payroll-related communications.
## Incident Details
- **Discovery Date:** August 7, 2026 (Publication Date)
- **Incident Date:** Circa 2024–2026 (Ongoing campaign)
- **Affected Organization:** Multiple organizations targeted
- **Sector:** Cross-sector; specifically targeting Finance, HR, and Administrative functions
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** Ongoing
- **Vector:** Phishing via voicemail impersonation.
- **Details:** Victims receive emails claiming to be voicemail notifications containing links that initiate a complex redirect chain.
### Lateral Movement
- **Techniques:** Post-compromise, attackers used Microsoft Graph API to enumerate users and identify high-value targets in payroll and finance departments.
### Data Exfiltration/Impact
- **Details:** Attackers collected mailbox contents specifically related to invoices, banking, and payroll operations. In some instances, malicious inbox rules were created to hide attacker activities from the user.
### Detection & Response
- **Detection:** Identified via analysis of suspicious redirect chains and sign-ins from residential proxy networks.
- **Response:** (General) Invalidation of active session tokens and blocking of known malicious infrastructure.
## Attack Methodology
- **Initial Access:** Multi-stage phishing redirecting through Google Meet, Google Ads, and Amazon S3.
- **Persistence:** Refreshing stolen session tokens approximately every eight hours.
- **Privilege Escalation:** Not explicitly noted; relied on the privileges of the compromised financial/HR accounts.
- **Defense Evasion:** Use of residential proxy networks to mask sign-in origins; fingerprinting and geolocation of victims to match subsequent login profiles.
- **Credential Access:** AiTM proxying to intercept authenticated session tokens (bypassing MFA/passwords).
- **Discovery:** Microsoft Graph API enumeration for organizational role identification.
- **Collection:** Targeting specific financial keywords and mailbox contents.
- **Exfiltration:** Stealthy email collection.
- **Impact:** Compromise of sensitive financial workflows and PII.
## Impact Assessment
- **Financial:** High risk of fraudulent wire transfers or payroll diversion.
- **Data Breach:** Compromise of payroll records, invoices, and banking details.
- **Operational:** Disruption to financial workflows.
- **Reputational:** Significant risk due to the sensitivity of HR and payroll data.
## Indicators of Compromise
- **Network Indicators:**
- `meet[.]google[.]com/` (abused for redirection)
- `s3[.]amazonaws[.]com/` (abused for hosting phishing logic)
- Traffic associated with residential proxy providers (e.g., used for session refreshing).
- **Behavioral Indicators:**
- New inbox rules created immediately following a login from an unfamiliar residential IP.
- Unusual Microsoft Graph API queries for user roles and directory enumeration.
## Response Actions
- **Containment:** Revoke all active Refresh Tokens for suspected compromised accounts.
- **Eradication:** Remove malicious inbox rules and scan for unauthorized enterprise applications.
- **Recovery:** Forced password resets (as a precaution) and re-registration of MFA devices if necessary.
## Lessons Learned
- **MFA Bypass:** Traditional MFA is susceptible to AiTM proxy attacks; session token theft is a primary vector in modern cloud environments.
- **Living off the Land (Cloud):** Attackers successfully leveraged trusted domains (Google, Amazon) to bypass email filters and reputation-based security.
## Recommendations
- **Phishing Defense:** Implement FIDO2-compliant security keys (WebAuthn) to provide hardware-backed protection against AiTM proxies.
- **Access Policies:** Implement Conditional Access policies that require "Compliant" or "Microsoft Entra Joined" devices to minimize the utility of stolen tokens on non-corporate machines.
- **Monitoring:** Enable alerts for suspicious mailbox rule creation and high-volume Microsoft Graph API activity.