Storm-2755 Hijacks Microsoft 365 Sessions to Redirect Payroll Deposits

Microsoft said the financially motivated threat actor Storm-2755 targeted Canadian employees in payroll diversion attacks by compromising Microsoft 365 accounts and changing salary payments to attacker-controlled bank accounts. The campaign used SEO poisoning and malvertising to lure victims to bluegraintours[.]com, where an adversary-in-the-middle phishing flow captured credentials, session cookies, and OAuth tokens, allowing the attackers to bypass MFA through token replay and gain persistent access to victim accounts.

After entering compromised tenants, Storm-2755 searched for payroll and HR workflows, created inbox rules to hide messages about direct-deposit or banking changes, and in some cases manually accessed HR SaaS platforms such as Workday to alter payment details. Microsoft reported indicators including Entra error code 50199, a user-agent shift to Axios 1.7.9 with the same session ID, and recurring non-interactive OfficeHome sign-ins about every 30 minutes; the company said it assisted affected organizations, carried out tenant takedowns, and urged defenses including phishing-resistant MFA, token revocation, Conditional Access, continuous access evaluation, suspicious inbox-rule monitoring, and device compliance enforcement.