Microsoft 365 phishing campaign harvests payroll and finance mailboxes
Arctic Wolf Labs has identified a widespread email-driven phishing campaign that uses adversary-in-the-middle (AitM) techniques to take over Microsoft 365 accounts and collect messages connected to payroll, HR and finance. The security firm said it observed hundreds of organizations targeted by email during the previous month, with successful intrusions across multiple victim environments.
The activity affects organizations in healthcare, education, manufacturing, government and professional services in the United States, Canada and Europe. Its stated objective is to identify employees involved in financial workflows and gather the mailbox content relevant to those functions.
Trusted services form part of the phishing route
The attack begins with voicemail-themed messages. Victims are led through a six-stage redirection chain to an AitM decoy page that proxies the legitimate Microsoft account authentication process, allowing the operators to capture credentials and multi-factor authentication codes.
Arctic Wolf Labs said the route starts with a Google Meet link-redirection URL, passes through Google outbound-link infrastructure, and reaches a Campaign Manager /ddm/clk dynamic click tracker. The tracker points to an HTML object hosted in an Amazon AWS S3 bucket, which redirects the browser to the attackers' AitM infrastructure. The use of familiar services is intended to sidestep reputation-based filtering.
The phishing page fingerprints the visiting system with JavaScript. It collects browser and operating-system details, screen and window dimensions, language, time-zone offset, cookie capability, WebDriver status, WebGL vendor and browser API availability, then sends the data to a PHP endpoint. It also queries the api.country[.]is geolocation service, storing the country result in an rcfh_country cookie for seven days before directing the browser to a proxied Microsoft OAuth authorization endpoint.
Session automation limits visible changes
After gaining access, the operators use Microsoft Graph API to enumerate tenant users associated with payroll, HR, finance and administrative functions. They then access messages concerning payroll, invoices, payments, banking, benefits and internal documents. The pattern overlaps with Payroll Pirate activity that Microsoft tracks as Storm-2755; related account-hijacking activity has been tracked as Storm-2657 since early 2025.
For broader context on email and credential threats, browser passwords and information stealer threats illustrates how browser-held passwords and information stealers can create adjacent exposure for business accounts. In this campaign, the phishing infrastructure uses the collected country information to support malicious sign-ins from residential proxy exit nodes in the victim's country within minutes of the initial compromise.
Arctic Wolf Labs observed recurring sign-ins 11 to 24 hours after anomalous activity, generally at eight-hour intervals and from rotating residential proxy addresses. Events reported Microsoft Outlook as the client application but used Firefox 131.0, Firefox 151.0 or occasionally Python Requests user agents rather than the expected Edge user agent. A shared SessionID persisted while source IP address, ASN and location changed, which the firm said indicated centralized session-refresh automation.
Detection needs to focus on session behaviour
Most investigated intrusions were limited to session maintenance, reconnaissance and mailbox collection. Arctic Wolf Labs did not observe MFA-method changes, device registration, credential changes, lateral phishing or inbox-rule creation in most cases, although some operators created rules that moved selected messages to Deleted Items and marked them as read.
For businesses, the practical implication is to investigate suspicious OAuth sign-ins alongside mailbox access patterns, especially stable session identifiers appearing from changing residential IPs, unusual browser and operating-system combinations, and recurring eight-hour authentication activity affecting finance-related accounts.