Executive Summary:

SRA identified an active ‘Payroll Pirate’ intrusion campaign across multiple incident response engagements. The activity appears to align with campaigns that Microsoft attributes to Storm-2755 and the related cluster Storm-2657. This campaign follows a well-documented pattern: AiTM session theft to capture authenticated Microsoft 365 tokens, token replay to bypass MFA, Microsoft Graph enumeration to identify payroll and HR personnel, and salary payment redirection through HR staff social engineering or direct modification of banking details in platforms such as Workday.

The Graph API reconnaissance queries observed in each environment were nearly identical, targeting users whose attributes match keywords such as payroll, pay, hr, human, resources, support, info, finance, account, and admin, while using $top=999 and $skiptoken pagination for bulk harvesting. Access tokens observed in the Graph activity matched tokens previously issued during a non-interactive user sign-in, providing evidence of session token theft and replay rather than credential compromise alone.

The attack chain is identity and cloud-based, so detection depends on Microsoft Entra sign-in telemetry and Microsoft Graph activity logs rather than endpoint EDR. Based on this activity, SRA recommends that organizations enable Microsoft Graph activity logging and ship those logs to a Security Datalake to provide visibility into the reconnaissance stage of this campaign. This blog details the attack chain SRA reconstructed across these engagements and provides the detection and hunting queries used during investigation.

Background

The activity SRA observed shares overlap with “payroll pirate” campaigns documented publicly by Microsoft, though SRA has not independently attributed this activity to a specific actor. In April 2026, Microsoft documented a campaign it tracks as Storm-2755 targeting Canadian employees. In that reporting, the actor used SEO poisoning and malvertising to push the domain bluegraintours[.]com to the top of search results for generic terms like “Office 365.” Victims who clicked on it landed on a fraudulent Microsoft 365 sign-in page that proxied the entire authentication flow in real time, capturing session cookies and OAuth access tokens and defeating any MFA method that is not phishing resistant.

Microsoft documented similar tradecraft from a separate cluster, Storm-2657, against US universities in 2025, involving phishing-based initial access and attacker-controlled MFA device enrollment for persistence. Across both documented campaigns and the activity SRA observed, the playbook converges on the same endgame: find the people who control payroll, then either try to trick them into changing direct deposit details or attempt to access an HR platform such as Workday as the victim.

Activity Observed in SRA-Monitored Environments

Across multiple IR engagements, SRA observed a consistent set of attacker behaviors. The following activity was common across investigated environments:

• Initial failed authentications. The actor’s initial attempts produced failed OfficeHome sign-ins with ResultType 90014 (a required credential field was missing) and an iOS source operating system. These attempts originated from seemingly random US mobile carrier IP space.
• Account takeover sequence. An interactive sign-in to Microsoft Outlook with error code 50199 (Login:reprocess) was immediately followed by a Cmsi:cmsi interactive sign-in, both from user-agent Firefox 142.0 on Windows. Within 30 seconds, a non-interactive OAuth2:Token sign-in requested a Microsoft Graph token, with the user-agent shifting to Firefox 131.0.
• Token replay characteristics. The Graph token requests presented as nonInteractiveUser logons from unmanaged, device-less sessions claiming multiFactorAuthentication, and carried the same UniqueTokenIdentifier values later observed in the Graph API enumeration.
• Graph reconnaissance. Enumeration began with a bulk pull of /v1.0/users?$top=999, followed by OR-chained $search queries across displayName, givenName, surname, jobTitle, mail, and userPrincipalName for payroll and HR keywords, paginated with $skiptoken.
• Infrastructure split. Graph enumeration traffic originated primarily from Canadian residential ISP space (Videotron, Rogers, TELUS, Bell, Shaw), while initial authentication attempts came from US mobile carriers. This split is consistent with residential proxy infrastructure.
• Broad delegated scopes. Tokens used in the enumeration carried extensive delegated permissions, including Directory.Read.All, Files.ReadWrite.All, Group.ReadWrite.All, Chat.ReadWrite, and User.ReadWrite, giving the actor wide latitude beyond directory reads.
• Persistent token-based access. In environments where accounts had not yet been remediated at the time of investigation, non-interactive sign-ins to Office 365 Exchange Online continued approximately every three hours, using the Firefox 131.0 user-agent, originating from IPs across multiple US states, and presenting a new token identifier with each occurrence.

The Visibility Problem

The reconnaissance stage of this campaign is invisible without Microsoft Graph activity logs. These logs are not enabled by default, and, historically, many teams evaluated them, found them noisy, and moved on. They have improved substantially and now capture the full RequestUri of every Graph call, which is exactly where this actor’s tradecraft lives. If your organization does not have Graph activity logs flowing to a SIEM or Data Lake, consider enabling them.

Detection Opportunities

• Graph API /v1.0/users requests combining $search with payroll, HR, and finance keywords, $top=999, and $skiptoken pagination (GraphAPIAuditEvents).
• Non-interactive Microsoft Outlook sign-ins requesting Microsoft Graph tokens via OAuth2:Token from unmanaged, device-less sessions with an uncommon browser signature (EntraIdSignInEvents).
• Interactive Login:reprocess (50199) sign-ins immediately followed by Cmsi:cmsi from the same account and user-agent.
• Failed OfficeHome sign-ins with ResultType 90014 and an MFA requirement skipped due to remembered device step detail, sourced from mobile carrier IP space.
• New-InboxRule operations that delete or hide messages containing direct deposit, hr, or bank keywords (OfficeActivity / CloudAppEvents).
• In environments with HR or payroll SaaS platforms connected to a CASB or audit pipeline, monitor for payment election and bank account changes, profile or account modifications, and unexpected MFA device enrollments (CloudAppEvents or equivalent platform audit logs).

Querying GraphAPIAuditEvents requires Microsoft Graph activity logs to be enabled and ingested. The primary reconnaissance stage of this campaign is invisible without them.

Recommendations

• Phishing-Resistant MFA and Conditional Access Enforcement. Deploy FIDO2/passkeys, Windows Hello for Business, or Certificate-Based Authentication, then enforce them through Conditional Access authentication strength policies for employees and external users accessing critical applications. Enabling phishing-resistant methods without enforcement allows attackers to force victims down to weaker authentication paths during the phishing flow.
• Enable Microsoft Graph activity logs and ship them to a SIEM or Security Datalake. Graph audit telemetry detected this campaign and is the only data source covering the directory reconnaissance stage. SRA is coordinating onboarding instructions for monitored clients.
• Remediate compromised accounts fully. Revoke all active sessions and refresh tokens via the Entra Admin Center or M365 Admin Center (not the Azure Portal), reset credentials, re-register MFA methods, remove malicious inbox rules, review application consent grants, and revert any payroll or banking changes. Application consent grants deserve particular scrutiny. The broad delegated scopes observed in this activity raise the possibility of OAuth-based persistence through a consented application, which survives password resets, token revocation, and MFA re-registration entirely. Audit enterprise applications and consent grants for anything added or modified during the compromise window.
• Harden session controls. Enforce Conditional Access requiring compliant or hybrid-joined devices, enable continuous access evaluation (CAE) to revoke tokens when risk conditions change, and apply sign-in frequency controls to limit replayed session lifetime.
• Alert on suspicious inbox rule creation. Rules that delete or hide messages matching direct deposit, bank, or payroll keywords are a high-fidelity signal of payroll fraud staging.
• Monitor HR SaaS platforms. Connect Workday (or equivalent) to Microsoft Defender for Cloud Apps and alert on payment election changes, account changes, and new MFA device enrollments.
• SRA published related research on AiTM session theft in Defending and Threat Hunting AiTM Phishing, which can be leveraged to harden against this campaign and similar token-replay activity.

Detection and Hunting

The following queries were used to identify compromised accounts and reconnaissance activity across affected environments:

Query #1: Identifies the initial failed OfficeHome authentications (ResultType 90014) observed for compromised users.

Query #2: Detects the interactive takeover sequence of Login:reprocess (error 50199) followed by Cmsi:Cmsi sign-ins to Microsoft Outlook from the Firefox 142.0 user-agent.

Query #3: Detects non-interactive Outlook sign-ins requesting Microsoft Graph tokens from unmanaged, device-less sessions with the Firefox 131.0 user-agent. Results carried the same token identifiers seen in the Graph API enumeration, and all were related to malicious activity.

Query #4: Detects bulk Graph API user enumeration via /v1.0/users?$top=999. This request preceded the keyword searches and did not appear outside of malicious activity in any affected environment.

Query #5: Detects successful OR-chained $search enumeration with $skiptoken pagination, indicative of automated directory scraping.

Query #6: Detects Graph API searches targeting payroll, HR, and finance keywords. The default output summarizes per account with query counts, timestamps, distinct IPs, and application IDs to separate sustained automated reconnaissance from incidental searches. Swap the summarize block for the commented project line to review individual events.

Query #7: Detects continued token replay sign-in activity from non-remediated accounts, including recurring non-interactive Exchange Online sign-ins observed approximately every three hours. Run after remediation to confirm session revocation was complete.

Indicators of Compromise

MITRE ATT&CK

References

• Investigating Storm-2755: “Payroll pirate” attacks targeting Canadian employees
• Investigating targeted “payroll pirate” attacks affecting US universities
• Investigating OAuth App Abuse with the Graph Activity Log
• Microsoft Entra authentication and authorization error codes
• Defending and Hunting AiTM Attacks – Security Risk Advisors
• Tycoon 2FA AiTM detection for Entra ID and Google — Elastic Security Labs