Payroll pirate attacks targeting Canadian employees

Storm-2755 is a financially motivated threat actor conducting payroll pirate attacks targeting Canadian employees. The campaign uses malvertising and SEO poisoning to redirect victims searching for terms like "Office 365" to fraudulent sign-in pages. By employing adversary-in-the-middle techniques, the attacker captures authentication tokens and session cookies, bypassing MFA protections. The actor maintains persistence by replaying stolen tokens and performs discovery to identify payroll and HR contacts. They impersonate compromised users to socially engineer HR staff or directly manipulate payroll systems such as Workday. Malicious inbox rules are used to hide attacker communications. These attacks have resulted in direct financial losses through redirected salary payments to attacker-controlled bank accounts.

• Clean Install, Stolen Creds: Fake WatchGuard VPN Site Serves Genuine Signed ClientCampaign2026-10-13
• Hallucinating Credibility: China-Aligned TA419 Impersonates its Way into US AI Policy CirclesCampaign2026-10-01
• SEO Poisoning Campaign Targets DeepSeek Users: Chinese Threat Actor Deploys Kong RAT via Multi-Stage AttacksMalware2026-10-29
• September 2026 Infostealer Trend ReportMalware2026-10-28
• Locked and Loaded: Phishing through Fake Bids and Protected DocumentsCampaign2026-10-27