Microsoft 365 accounts hijacked through relayed sign-ins to reach payroll email

Arctic Wolf Labs is tracking an ongoing phishing campaign against Microsoft 365 that compromises accounts even where multi-factor authentication is enabled, then uses automation and rented residential internet connections to hold those sessions open and read the mailboxes of staff who handle payroll and payments. The researchers observed hundreds of organisations targeted by email during July 2026, with confirmed intrusions across a wide range of environments. The campaign overlaps with activity Microsoft tracks under the label Storm-2755, part of a cluster known as Payroll Pirates.

What happened

The lure is mundane by design: an email dressed as an automated voicemail notification, complete with a fabricated caller reference to make it look routine. Clicking through passes the recipient along a chain of redirects that hop through well-known and widely trusted services before landing on the attackers’ own page, which is how the link survives filters that judge destinations by reputation.

What waits at the end is not a fake login form. It is a proxy that sits between the employee and Microsoft and passes every request through to the real service. The password is real and Microsoft checks it. The multi-factor prompt is real, the employee approves it, and it passes. Microsoft then returns the resulting sign-in material to the attacker’s address rather than the employee’s browser, and the employee is forwarded on to the genuine Office 365, having seen nothing out of place.

Before the sign-in page appears, the attackers’ infrastructure profiles the visiting browser, collecting details such as the operating system, screen dimensions, language and time zone, and whether the session appears to be an automated one. It also looks up the visitor’s country through a free geolocation service and stores that country for a week.

That last detail explains the campaign’s most effective evasion. When the attackers log in afterwards, they come from a residential internet connection in the same country as the victim, rented through a proxy network. To the tenant, a sign-in that would otherwise stand out as coming from an unexpected country instead looks like an ordinary consumer connection nearby. Arctic Wolf could not directly observe the server-side logic making that selection, and says so, which is the right level of caution for an inference of that kind.

Why this one is hard to spot

The restraint is the notable part. In most of the intrusions investigated, the attackers did not change multi-factor settings, register new devices, alter credentials, send onward phishing, or create hiding rules in the mailbox. Those are exactly the behaviours that account-takeover alerting is usually built around. By skipping them, the operation avoided the tripwires most organisations already have.

Instead the attackers used Microsoft’s own administrative interface to search the tenant for staff whose roles relate to payroll, HR, finance and administration, then opened messages about payroll, invoices, payments, banking and benefits. Audit records confirmed that message contents were retrieved rather than merely listed. A small number of cases did involve someone working by hand, creating rules that moved selected messages to Deleted Items and marked them read, and those interactive sign-ins came from hosting providers rather than the residential proxies used by the automation.

There is also a deliberate delay. The automated session refreshing typically began 11 to 24 hours after the initial compromise, which separates the suspicious activity from the phishing email that caused it and makes the two harder to connect during an investigation.

What defenders can actually hunt for

The useful half of the research is that the machinery holding these sessions open is repetitive in ways a human user is not.

Sign-ins recur at roughly eight-hour intervals from rotating addresses while carrying the same session identifier, so a single session appears across several networks, providers and countries within a short window. The client is reported as Microsoft Outlook while the browser signature is Firefox or a scripting library rather than the expected one. Some sign-ins report device combinations that cannot exist, such as a mobile browser running on desktop Windows. And mailbox reads in entirely unrelated organisations cluster into the same few seconds, which points at one central system working through a list.

Arctic Wolf also identifies a specific pairing of application and interface identifiers in mailbox access records that it found in no legitimate activity across its telemetry, which makes it a high-confidence indicator on its own. The full technical indicators, along with a MITRE ATT&CK mapping, are published in the company’s public repository rather than reproduced here.

One caveat carries more weight than the rest: much of this activity appears only in non-interactive sign-in records. Organisations that have turned off or discarded that telemetry, often to control logging costs, cannot see the refresh pattern at all.

Context

This is a specific instance of the year’s broadest pattern rather than a novel technique. Cisco Talos reported authentication abuse in 65 percent of its incident response engagements last quarter, up from 35 percent, with adversary-in-the-middle proxies and session theft among the leading methods. Sophos found that 97 percent of ransomware victims whose intrusion began with stolen credentials already had multi-factor authentication enabled somewhere in the estate.

Read together, those findings and this campaign say the same thing. Approval-based multi-factor authentication has become something attackers plan around rather than something that stops them, and the industry’s answer, phishing-resistant methods that bind a sign-in to the real website, is available today but unevenly deployed.

Why it matters

For anyone who uses a work email account, the practical lesson is that the old advice to check the address bar has quietly stopped being sufficient. In this campaign the sign-in page is the real Microsoft page, relayed, and the approval request is real too. The thing worth noticing is no longer whether the page looks right but whether you expected to be asked at all. A voicemail notification you were not waiting for is a reason to go to the service directly rather than follow the link, and an approval prompt you did not trigger should be refused and reported rather than dismissed.

For organisations, this is a payroll fraud campaign wearing an email compromise costume. The mailbox reading is reconnaissance, and the money is expected to move later through the HR or payroll platform when a direct deposit account is quietly changed. That means the investigation cannot stop at the mailbox. If an account in your finance or HR function is implicated, the payroll system needs auditing across the whole suspected period, not just the email. It also means the decision to fund longer log retention and phishing-resistant authentication is now a fraud-prevention decision with a measurable loss attached, which is a considerably easier case to make to a board than a general improvement in security posture.

For practitioners, the durable detections are behavioural rather than infrastructural. Domains and proxy addresses rotate constantly and blocklists will age within days, but the eight-hour refresh cadence, the single session appearing across many networks, and the client and browser mismatch survive that churn. Correlate identity, session and mailbox telemetry together rather than judging sign-ins one at a time, and confirm before you need it that non-interactive sign-in logs are being retained and ingested.

Last verified: 7 August 2026. This is an active campaign and the attackers’ infrastructure is changing continuously, so indicators published today will age quickly. Attribution reflects the researchers’ assessment at the time of publication.