A financially driven cybercriminal group known as Storm-2755 is intercepting salary payments of Canadian workers by taking over their accounts through payroll scams.

The attackers employed fake Microsoft 365 login pages to capture victims’ credentials and session information. They lured users to malicious sites (like bluegraintours[.]com) disguised as Microsoft 365 login forms, which were prominently displayed in search results using deceptive advertising or SEO manipulation.

This enabled Storm-2755 to bypass multifactor authentication (MFA) in man-in-the-middle (AiTM) attacks by replaying the stolen session data instead of requiring a new login.

“Instead of just collecting usernames and passwords, AiTM systems intercept the entire login process in real-time, capturing session cookies and OAuth access tokens upon successful authentication,” Microsoft stated.

“Because these tokens represent a validated session, attackers can use them to access Microsoft services without needing credentials or MFA, bypassing standard MFA protections not designed to resist phishing.”

After accessing an employee’s account, the attacker set up rules to automatically move emails from HR staff containing phrases like “direct deposit” or “bank” to hidden folders, preventing the employee from seeing them.

Next, they searched for keywords like “payroll,” “HR,” “direct deposit,” and “finance,” and then emailed HR staff using subject lines such as “Question about direct deposit” to trick them into changing banking details.

When direct social engineering did not work, the attacker logged into HR software like Workday, utilizing the stolen session information to update direct deposit information manually.

To strengthen defenses against AiTM and payroll fraud, Microsoft advises blocking older authentication methods and using MFA that resists phishing.

If there are signs of a security breach, organizations should immediately revoke any compromised tokens and sessions, remove suspicious inbox rules, and reset MFA settings and credentials for all compromised accounts.

In October, Microsoft took action against a similar payroll fraud operation targeting Workday accounts since March 2025. In that case, a cybercrime group called Storm-2657 targeted university employees across the U.S. to reroute their salary payments.

In these attacks, Storm-2657 compromised accounts using phishing and stole MFA codes with AITM methods, allowing them to access the victims’ Exchange Online accounts.

Payroll fraud is a type of business email compromise (BEC) scam targeting businesses and individuals involved in regular wire transfers. Last year, the FBI’s Internet Crime Complaint Center (IC3) reported over 24,000 BEC complaints, resulting in over $3 billion in losses, making it the second most profitable type of crime behind investment fraud.