Payroll Pirates Abuse Microsoft Graph to Find HR and Finance Staff After Account Compromise

A widespread phishing operation that compromises Microsoft 365 accounts through adversary-in-the-middle (AiTM) infrastructure, then uses Microsoft Graph to identify employees handling payroll, finance, HR, benefits, invoices, and banking workflows.

The activity closely overlaps with Microsoft’s “Payroll Pirates” cluster, tracked as Storm-2755.

Researchers also found similarities with activity previously documented by Security Risk Advisors, indicating that the operation’s targeting may be broader than initially reported.

Initial access begins with voicemail-themed phishing emails masquerading as automated call notifications.

The messages use Microsoft branding, fabricated caller details, and an “OPEN [Organization] VOICEMAIL PORTAL” lure to create urgency.

Clicking the link sends victims through a layered redirect chain that abuses legitimate Google Meet redirectors, Google advertising infrastructure, Campaign Manager click trackers, and Amazon S3-hosted content before landing on attacker-controlled AiTM phishing domains.

The phishing kit proxies the legitimate Microsoft authentication process in real time rather than presenting a static credential-harvesting page.

As a result, victims may complete the normal Microsoft sign-in and MFA flow, while the proxy captures authentication artifacts and session material returned during the OAuth callback.

This makes traditional MFA insufficient when users are tricked into authenticating through a malicious reverse proxy.

Before serving the proxied login flow, the infrastructure fingerprints visitors through a PHP endpoint. The JavaScript collects browser, operating-system, hardware, WebGL, language, screen-resolution, cookie, and WebDriver information.

It also queries a public geolocation service and stores the victim’s country code in a cookie.

These measures likely help operators filter security researchers and automated analysis systems while selecting geographically plausible proxy infrastructure for subsequent access.

Arctic Wolf Researchers said that, the campaign, active across North America and Europe, has targeted organizations in healthcare, education, manufacturing, government, and professional services.

After account takeover, the actors use rotating residential proxies to make malicious Microsoft 365 sign-ins resemble ordinary consumer traffic.

Arctic Wolf observed suspicious OfficeHome authentication activity shortly after victims visited phishing pages, sometimes involving multiple residential IP addresses and implausible browser-and-operating-system pairings.

Some authentication attempts generated Microsoft Entra error 90014, linked to a missing OAuth nonce parameter, an unusually rare condition for the first-party OfficeHome application.

Payroll Pirates Abuse Microsoft Graph

The most durable signal emerged after compromise. Roughly 11 to 24 hours after initial access, attackers began refreshing stolen sessions at approximately eight-hour intervals.

These sign-ins retained the same SessionID but originated from changing IP addresses, ASNs, and locations.

They also frequently claimed to use Outlook while presenting anomalous Firefox or Python Requests user agents instead of expected Microsoft client behavior.

The operators then pivoted to Microsoft Graph reconnaissance, enumerating tenant users associated with finance, payroll, HR, administrative, and payment functions.

In Defender XDR, this generated “Suspicious Exchange Online Graph Reconnaissance Activity” alerts, often using the axios/1.18.1 user agent.

The actors subsequently accessed mailbox content relating to payroll, invoices, payments, banking, benefits, and internal documentation.

Cross-tenant mailbox collection occurred in tightly synchronized bursts, suggesting centralized automation rather than isolated manual activity.

Most intrusions avoided conventional business email compromise behavior such as MFA changes, password resets, device registration, outbound phishing, and inbox-rule creation.

That restraint reduces obvious detection opportunities while preserving long-term access to financially valuable communications.

Defenders should correlate phishing telemetry with Entra sign-ins, SessionID reuse, residential-proxy rotation, anomalous Outlook user agents, Graph reconnaissance, and MailItemsAccessed events.

Detecting the complete behavioral chain is more reliable than relying on a malicious domain, a single IP address, or a single authentication anomaly.

Why use the 2026 Agentic SOC Buyer’s Guide? 8 Best Platforms Compared – Download the 2026 Buyer’s Guide