A phishing campaign that has been busy since at least July is doing something unusual: instead of firing off fraudulent emails, it sits still and reads them. That restraint is exactly what makes it hard to catch. Arctic Wolf Labs is tracking the operation, which uses adversary-in-the-middle (AitM) techniques to hijack Microsoft 365 accounts and then find the people who handle payroll, invoices, and banking. The firm counted hundreds of targeted organizations in July 2026 alone, with confirmed break-ins across healthcare, education, manufacturing, government, and professional services in the U.S., Canada, and Europe.
The activity overlaps with a financially motivated cluster known as Payroll Pirates, which Microsoft tracks as Storm-2755. The eventual payoff for these groups is usually salary diversion, rerouting an employee’s paycheck into an account the attacker owns. What Arctic Wolf documented looks like the patient reconnaissance that sets that up.
A login page that is real, just not yours
The lure is a voicemail notification wrapped in Microsoft branding, complete with a fake caller ID and reference number to manufacture urgency. Clicking through starts a six-stage redirect chain that hops through trusted services like Google Meet, Google Ads, and an Amazon S3 bucket before it lands on the attacker’s page. Routing traffic through reputable domains helps the links slip past filters that judge a message by where it points.
The page victims reach is not a static fake. It is a proxy that relays Microsoft’s genuine sign-in flow in real time. You type your password, you approve the MFA prompt, and everything works, because you really are talking to Microsoft, just with someone in the middle copying the session token as it goes by. Before any of that, hidden JavaScript fingerprints the browser and looks up the visitor’s country, tucking it into a cookie for later.
Built to look boring
Why would attackers bother logging where a victim lives? So their follow-up logins can come from a residential proxy in the same place. A sign-in from the victim’s own city, over a home connection, barely registers as odd. Arctic Wolf found the intruders returning at roughly eight-hour intervals from rotating residential IPs, keeping one session alive through automation while the address and location kept shifting.
The tooling still leaves prints. Some sessions reported Outlook running on Firefox, or even Python Requests, which real Outlook never does, and a few showed impossible pairings like mobile Safari on Windows 10. In most cases the attackers changed nothing that would trip an alarm: no new devices, no password resets, no forwarding rules. A few got hands-on and quietly swept certain replies into Deleted Items to keep them out of sight.
MFA alone will not save you
Here is the uncomfortable part for anyone who treats multi-factor authentication as a finish line. Because the token is captured after the code is entered, ordinary MFA does nothing against this. Phishing-resistant options like FIDO2 security keys or Windows Hello for Business do hold up, since there is no code for a proxy to pass along. Teams on Microsoft 365 E3 or E5 can also comb their audit logs for the odd client and browser signals Arctic Wolf published.
The takeaway is a little counterintuitive: the intruder who steals nothing and breaks nothing is the one you spot last. If someone approves a change to bank details this quarter, confirm it by phone before the money moves.
This website uses cookies.