Storm-2755 is a financially motivated threat actor targeting Canadian users with payroll pirate attacks. The campaign leverages malvertising and SEO poisoning to redirect victims searching for terms like "Office 365" to fraudulent sign-in pages. Through adversary-in-the-middle (AITM) techniques, the attacker captures authentication tokens and session cookies, effectively bypassing MFA protections. Persistence is maintained by using the Axios HTTP client to replay stolen tokens. The actor performs discovery to identify payroll and HR contacts, then impersonates compromised users to socially engineer HR personnel or directly manipulate payroll systems such as Workday. Malicious inbox rules are deployed to conceal attacker communications. The attacks have caused direct financial losses by redirecting salary payments to attacker-controlled bank accounts. No patch or official remediation guidance is provided in the available data.

The threat actor successfully bypasses MFA protections by capturing authentication tokens and session cookies, enabling unauthorized access to user accounts. This access is used to discover payroll and HR contacts and manipulate payroll systems, resulting in direct financial losses through redirected salary payments. The use of malicious inbox rules to hide correspondence further complicates detection and response. The campaign specifically targets Canadian employees, causing financial and operational impacts to affected organizations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations should monitor official Microsoft security advisories for updates related to CVE-2025-27152 and the Storm-2755 campaign. Given the attack techniques, consider enhancing detection capabilities for adversary-in-the-middle attacks, token theft, and suspicious mailbox rule creation. Educate HR and payroll staff about social engineering risks and verify any payroll change requests through out-of-band channels. Since no official fix is currently documented, vigilance and layered defense are critical.