Payroll Pirate Uses Microsoft Graph and AiTM Session Theft to Redirect Salaries

Attackers in the Payroll Pirate campaign are targeting HR, payroll, finance, and administrative staff by using adversary-in-the-middle phishing pages to steal active Microsoft 365 session tokens and take over accounts without needing passwords or defeating MFA directly. Researchers linked the activity to Microsoft-tracked clusters Storm-2755 and Storm-2657, which have targeted organizations across sectors including healthcare, manufacturing, and food services to alter direct-deposit details and reroute employee pay to attacker-controlled bank accounts.

After gaining access, the actors use Microsoft Graph API queries to enumerate directory users and identify payroll-related roles, leaving little or no endpoint evidence and shifting detection to Microsoft Entra sign-in telemetry and Graph activity logs. Investigators observed authentication traffic from U.S. mobile carrier IP ranges and follow-on directory reconnaissance from Canadian residential ISP addresses, suggesting proxy-backed operations; defenders were urged to enable Graph logging, revoke compromised sessions and tokens, tighten Conditional Access, deploy phishing-resistant MFA such as FIDO2 or Windows Hello for Business, audit OAuth consent and enterprise applications for persistence, and review payroll changes made during the compromise window.