Cybersecurity researchers have called attention to an active “widespread email-driven phishing campaign” that employs adversary-in-the-middle (AitM) techniques to take control of Microsoft 365 accounts with an aim to identify key personnel involved in financial workflows and gather related email.
“The campaign uses residential proxies to disguise malicious sign-ins as ordinary consumer traffic,” Arctic Wolf Labs said. “Automated activity maintains compromised sessions at approximately eight-hour intervals.”
The activity is assessed to impact organizations across healthcare, education, manufacturing, government, and professional services sectors located in the U.S., Canada, and Europe. It shares tactical overlaps with Payroll Pirate attacks tracked by Microsoft under the moniker Storm-2755.
Payroll Pirates is the designation assigned to a broader financially motivated threat cluster that involves hijacking the accounts of employees to reroute salary payments to attacker-controlled accounts. Some aspects of these campaigns have been documented since early 2025, with Microsoft tracking a related threat as Storm-2657.
Arctic Wolf said it observed hundreds of organizations being targeted by email as part of the latest phishing campaign last month, resulting in successful intrusions spanning a broad range of victim environments.
Attack chains involve the use of voicemail-themed phishing emails to lead victims to AitM decoy pages that act as a proxy for the legitimate Microsoft account authentication flow, while stealthily capturing their credentials and multi-factor authentication (MFA) codes.
This is accomplished by means of a six-stage redirection chain that employs legitimate and trusted services like Google, Google Meet, Google Ads, and Amazon S3 to sidestep reputation-driven filters.
“The chain begins with a Google Meet linkredirect URL, and continues through Google’s outbound-link infrastructure before reaching a Campaign Manager /ddm/clk dynamic click tracker,” Arctic Wolf said. “In the activity we observed, the destination embedded in the tracker URL pointed to an HTML object hosted in an Amazon AWS S3 bucket. The S3-hosted page then redirected the victim to the campaign’s AitM phishing infrastructure.”
The phishing pages also employ JavaScript to fingerprint the visiting host, gathering information about the web browser, operating system, screen and window dimensions, browser language, time zone offset, cookie capabilities, WebDriver status, WebGL vendor, and browser API availability. All this information is packaged and sent to a PHP endpoint through an HTTP POST request. The script then redirects the browser to the proxied Microsoft OAuth authorization endpoint.
It also queries a geolocation API (“api.country[.]is”) for the requester’s country code, and stores the result in a “rcfh_country” cookie with a seven-day expiration. Once initial access is obtained, the threat actor abuses the compromised sessions to collect emails from payroll and HR personnel who are involved in financial matters at the enterprise.
What’s more, controlled testing reveals that the malicious sign-in activity originates within minutes from a residential proxy exit node in the victim’s country, indicating that the threat actors are possibly leveraging the geolocation data to select geographically matched proxy infrastructure for subsequent logins and evade security controls that otherwise prevent access from unusual IP addresses.
Some of these sign-in events report “implausible browser and operating-system combinations,” such as mobile versions of Apple Safari or Google Chrome on Windows 10.
“Typically, 11 to 24 hours after the initial anomalous activity, malicious sign-ins began recurring at eight-hour intervals from rotating residential proxy addresses,” Arctic Wolf added. “These events reported Microsoft Outlook as the client application but used Firefox 131.0, Firefox 151.0, or occasionally Python Requests user agents rather than the expected Edge user agent.”
“The recurring sign-ins retained the same SessionID while the source IP address, ASN, and geographic location changed, providing further evidence that centralized automation was refreshing each compromised session independently.”
Like in the case of Storm-2755, the threat actors have been found relying on the Microsoft Graph API to enumerate tenant users associated with payroll, HR, finance, and administrative functions, and then accessing messages related to payroll, invoices, payments, banking, benefits, and internal documents..
In most intrusions investigated by the security vendor, the attackers are said to have restricted their post-compromise actions to session maintenance, reconnaissance, and mailbox collection. No other activity, including MFA-method changes, device registration, credential modification, lateral phishing, or inbox rule creation, has been observed.
“By avoiding these common BEC behaviors, the threat actors limited opportunities for early detection based on account modification or outbound email abuse,” Arctic Wolf added.
That said, a handful of cases involved the attackers engaging in hands-on keyboard activity to create inbox rules that automatically moved certain messages from Inbox to Deleted Items and marked them as read. There is evidence to suggest that the operators intervened selectively for account manipulation, while a centralized automation infrastructure handled other aspects of the attack.
“Using rotating residential proxies, the threat actor quietly maintained stolen sessions, identified personnel involved in financial workflows, and collected relevant mailbox data through automated activity,” Arctic Wolf said. “The delay between initial access and subsequent automation, combined with restrained post-compromise activity, makes the campaign harder to connect to the original phishing event and less likely to trigger existing detections.”
