A cybercriminal group with clear financial motives has been running a sophisticated operation against Canadian workers, quietly rerouting their paychecks into bank accounts the attackers control. The scheme was uncovered by researchers at Microsoft, who have been tracking the group’s methods in detail.

The Setup: Fake Ads, Poisoned Search Results, and a Very Convincing Login Page

The attackers, whom Microsoft has labeled Storm-2755, don’t bother targeting specific companies or industries. Instead, they cast a wide net geographically, going after Canadian users broadly. Their entry point is deceptively simple: they manipulate search engine rankings and place malicious advertisements tied to everyday search terms. Someone Googling “Office 365,” or even accidentally typing “Office 265,” might find themselves clicking a result that looks completely legitimate but it isn’t.

Clicking through drops the victim on a near-perfect counterfeit Microsoft 365 login page. What makes this more dangerous than a typical phishing site is that it doesn’t just harvest a password and move on. The fake page operates as a live relay between the victim and the real Microsoft servers, intercepting not just credentials but the authenticated session itself, including the session cookies and OAuth tokens, issued after login. By the time the victim thinks they’ve signed in normally, the attacker already has everything they need.

Under the Hood: A Borrowed Tool and an Exploited Vulnerability

The mechanism powering this session hijacking is built around Axios, a widely used and otherwise legitimate HTTP client library. Storm-2755 specifically used version 1.7.9 to ferry stolen authentication tokens back to infrastructure they controlled. This allowed them to keep sessions alive and act as the user without ever triggering a fresh login prompt hence effectively making the MFA step irrelevant for anyone not using phishing-resistant authentication methods.

What gives this extra bite is a known security flaw in the Axios library itself (CVE-2025-27152) which can be exploited to enable server-side request forgeries. Storm-2755 appears to have deliberately chosen this version to take advantage of that weakness. A technical tell that defenders can watch for: once the attacker takes over a session, the user-agent string in sign-in logs switches to Axios while the session ID stays the same, betraying the token replay in progress.

For most compromised accounts, the attackers were content to lurk. For a smaller number, they went a step further such as locking in their access by resetting the victim’s password and reconfiguring MFA settings, ensuring they’d keep control of the account even after the original stolen token expired.

The End Game: Intercepting the Paycheck

Once inside a victim’s inbox, Storm-2755 got to work methodically. Their first move was defensive: they set up hidden email rules to automatically bury any incoming messages containing words like “bank” or “direct deposit,” so that any HR responses would vanish into a folder the victim would never think to check.

With that cover in place, they sent an email from the victim’s own account to the company’s HR or finance team, requesting a change to direct deposit banking details. From HR’s perspective, the request looks entirely routine ’cause it’s coming from the employee’s real email address, in the employee’s name. If HR complies, the employee’s next paycheck goes straight to the attacker.

When that social engineering approach didn’t work, the group showed they had a backup plan. Rather than giving up, they logged directly into HR platforms like Workday using the stolen session and changed the banking information themselves without any HR interaction at all. In at least one confirmed case, this direct approach succeeded and a real employee suffered a real financial loss.

This Isn’t Just a Canadian Problem

While Storm-2755 directed this particular wave of attacks at workers in Canada, the underlying technique travels easily. The same playbook can be deployed against employees anywhere, in any organization that runs Microsoft 365 alongside cloud-based payroll or HR platforms. Microsoft has separately documented a related group, Storm-2657, running nearly identical schemes against university employees across the United States whick is a sign that payroll-redirect attacks are becoming a repeatable, scalable form of financial cybercrime.

What Organizations Can Do Right Now

  • Upgrade to phishing-resistant authentication. Standard MFA a.k.a. push notifications, one-time codes, offers no protection against AiTM attacks. FIDO2/WebAuthn passkeys are bound to the legitimate origin domain, making them impossible to intercept through a proxy. This is the single most effective technical control available.
  • Hunt for Axios in your sign-in logs. The presence of the Axios user-agent in authentication logs is a strong indicator of token replay activity. Security teams should also flag any pattern of non-interactive sign-ins to OfficeHome repeating at roughly 30-minute intervals.
  • Watch for suspicious inbox rules. Attackers rely on suppressing HR notifications to stay hidden. Automated alerts for newly created inbox rules, especially those filtering on financial keywords, can expose the operation early.
  • Call before you change. HR and payroll teams need a firm policy: any request to change direct deposit details must be verified through a separate channel, whether that’s a phone call, a video check-in, or an in-person confirmation. Email alone is not enough.
  • Enforce Conditional Access and retire legacy authentication. Requiring device compliance before granting access, and blocking older authentication protocols that can’t enforce modern controls, significantly shrinks the attack surface.
  • Deploy FileDNA CADR to address this by treating every incoming file, whether a Microsoft Office document, an Adobe PDF, or any other attachment, as a potential threat. Using deep structural analysis and recursive object-level inspection, it evaluates file composition and validates internal elements to detect hidden or suspicious content.

References