12 minhigh
Payroll Pirates: Strange New Tides in Business Email Compromise
Arctic Wolf Labs is tracking an active adversary-in-the-middle (AiTM) phishing campaign compromising Microsoft 365 accounts across multiple sectors and regions. The campaign uses voicemail-themed phishing emails with multi-stage redirect chains through legitimate services (Google Meet, Google Ads, AWS S3) to reach AiTM proxy domains that relay Microsoft authentication and intercept session tokens even when MFA is enabled. Stolen sessions are maintained via automated 8-hour sign-in cadences from rotating residential proxies, followed by Microsoft Graph reconnaissance of payroll/HR/finance personnel and coordinated mailbox collection. The campaign shares characteristics with Microsoft's Storm-2755 (Payroll Pirates) cluster and avoids traditional BEC behaviors to evade detection.
Sens:■ Immediate
Showing defanged values
- domainidp[.]keyreniao[.]comRedirector domain hosted on Hostinger; issues HTTP 302 to send victims to AiTM authentication proxy
- domainidp[.]korminel[.]comRedirector domain hosted on Hostinger; issues HTTP 302 to send victims to AiTM authentication proxy
- domainidp[.]kualabemo[.]comRedirector domain hosted on Hostinger; issues HTTP 302 to send victims to AiTM authentication proxy
- domainmsauth[.]monlinelogicaline[.]comAiTM authentication proxy domain using Microsoft-themed subdomain prefix
- domainmslogin[.]milocaroline[.]comAiTM authentication proxy domain using Microsoft-themed subdomain prefix
- domainmsonline[.]logicalineonline[.]comAiTM authentication proxy domain impersonating Microsoft login; proxies real Microsoft OAuth flow and intercepts session tokens
- domainoffice[.]ofrecie[.]comAiTM proxy domain using misspelled office subdomain naming pattern
Detection / Hunteropenrouter
What Happened
A large-scale phishing campaign is tricking employees into entering their Microsoft 365 login details on fake websites that look identical to the real Microsoft sign-in page. Even if employees use multi-factor authentication (like a code sent to their phone), the attackers intercept the login process in real time and steal the session that proves the user is logged in. The attackers then quietly maintain access to these accounts by automatically refreshing their stolen sessions every eight hours, using internet connections that look like normal home internet traffic to avoid suspicion. Once inside, they search for employees who handle payroll, human resources, and finance, then read their emails to gather information about payment processes. Organizations in healthcare, education, manufacturing, government, and professional services across North America and Europe have been affected. Defenders should check their Microsoft 365 audit logs for the specific patterns described in this report, deploy phishing-resistant authentication methods like hardware security keys, and ensure they are logging non-interactive sign-in activity.
Key Takeaways
- Active AiTM phishing campaign targeting Microsoft 365 accounts across multiple sectors using voicemail-themed lures and multi-stage redirect chains through Google Meet, Google Ads, and AWS S3
- Campaign shares significant overlap with Microsoft-tracked Storm-2755 (Payroll Pirates) cluster; uses residential proxies to disguise sign-ins and maintains sessions at 8-hour intervals
- Unique Client App ID (5d661950-3475-41cd-a2c3-d671a3162bc1) and API ID (c999ed3e-27ae-4cb3-b3a2-46b056af63d3) pairing in MailItemsAccessed events is a high-fidelity detection indicator not seen in legitimate Outlook activity
- Threat actors avoid common BEC behaviors (no MFA changes, device registration, or inbox rules in most cases), making detection harder; defenders must correlate identity, session, and mailbox telemetry
- Error code 90014 on first-party OfficeHome applications, combined with implausible browser/OS combinations, is strongly associated with campaign activity
Affected Systems
- Microsoft 365 / Microsoft Entra ID
- Exchange Online / Microsoft Graph API
- Organizations in healthcare, education, manufacturing, government, and professional services across the United States, Canada, and Europe
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Voicemail-themed phishing email with subject line pattern '[Organization] :ATTN: Review messages. Ref id: [random string]' directs victim to multi-stage redirect chain abusing Google Meet, Google Ads, and AWS S3
- Credential Harvesting: Redirect chain terminates at AiTM proxy domain (e.g., msonline.logicalineonline.com) that relays genuine Microsoft authentication flow, intercepting session tokens after MFA completion
- Fingerprinting & Geolocation: AiTM proxy fingerprinting endpoint (/st_58200519/class_identifier.php) collects browser environment data and queries api.country.is to determine victim country, storing result in rcfh_country cookie for proxy selection
- Persistence: Stolen session tokens maintained via automated sign-ins at 8-hour intervals from rotating residential proxy addresses (primarily anyIP), using Outlook client with Firefox user agents
- Reconnaissance: Microsoft Graph API queried using axios/1.18.1 user agent to enumerate users associated with payroll, HR, finance, and administrative functions
- Collection: Coordinated mailbox access across multiple tenants targeting messages related to payroll, invoices, payments, and banking via MailItemsAccessed events with anomalous Client App ID and API ID pairing
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: Yes
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: Yes
- Platforms: Microsoft 365 Unified Audit Logs, Microsoft Entra ID Sign-In Logs, Microsoft Defender XDR Advanced Hunting, Arctic Wolf public GitHub repository
The article provides KQL queries for Microsoft Defender XDR Advanced Hunting (GraphAPIAuditEvents filtering by ApplicationId), detailed detection guidance for Microsoft 365 Unified Audit Logs (MailItemsAccessed with anomalous AppID/API pairing), and Entra ID sign-in log analysis patterns. Additional IOCs and MITRE mappings are available in Arctic Wolf's public GitHub repository.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR telemetry is limited because the attack primarily operates through cloud identity and email APIs rather than endpoint execution. Microsoft Defender XDR generates 'Suspicious Exchange Online Graph Reconnaissance Activity' alerts, but traditional EDR endpoint signals are minimal since most activity is cloud-based API access. |
| Network Visibility | Medium | Network telemetry can detect the phishing redirect chain (Google Meet to Google Ads to S3 to phishing domain), DNS resolution patterns (Google Ads domains followed by newly registered domains), and HTTP response headers (openresty/1.31.1.1, x-powered-by: Express). However, post-compromise activity uses Microsoft Graph and Outlook APIs over legitimate Microsoft infrastructure, limiting network-based detection. |
| Detection Difficulty | Moderate | Individual indicators (error 90014, anomalous user agents, residential proxy IPs) have moderate false positive rates, but correlating multiple signals across identity, session, and mailbox telemetry significantly improves fidelity. The unique Client App ID and API ID pairing is high-fidelity. Difficulty arises from the need to ingest and correlate non-interactive sign-in logs, which some organizations have disabled. |
Required Log Sources
- Microsoft 365 Unified Audit Logs (MailItemsAccessed operations)
- Microsoft Entra ID Sign-In Logs (including non-interactive sign-ins)
- Microsoft Defender XDR Advanced Hunting (GraphAPIAuditEvents)
- DNS resolution logs
- Email gateway / Secure Email Gateway logs
- IP intelligence feeds for residential proxy identification
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for MailItemsAccessed events where the Client App ID is 5d661950-3475-41cd-a2c3-d671a3162bc1 (Microsoft Outlook) paired with API ID c999ed3e-27ae-4cb3-b3a2-46b056af63d3, as this combination does not appear in legitimate Outlook mail access | Microsoft 365 Unified Audit Logs — MailItemsAccessed operations with ClientAppId and APIId fields | Collection | Low — article states no legitimate instances of this pairing were identified across global telemetry |
| Consider hunting for Microsoft Outlook client application sign-ins using non-Edge browser user agents (Firefox 131.0, Firefox 151.0, or Python Requests), as legitimate Outlook access uses Edge | Microsoft Entra ID Sign-In Logs — client application and user agent fields | Persistence / Session Maintenance | Low to Medium — some legitimate browser extensions or third-party tools may use Outlook APIs with non-standard user agents |
| Consider hunting for sign-in events with error code 90014 on first-party OfficeHome applications, especially when paired with implausible browser/OS combinations (e.g., Mobile Safari on Windows 10) | Microsoft Entra ID Sign-In Logs — errorCode and appDisplayName fields with user agent parsing | Initial Access / Credential Harvesting | Low — article states this error is exceedingly rare for legitimate first-party Microsoft applications |
| Consider hunting for a single SessionID appearing across multiple ASNs and geographic regions within a short timeframe, indicating centralized automation refreshing compromised sessions from rotating proxies | Microsoft Entra ID Sign-In Logs — SessionId, IP address, ASN, and location correlation | Persistence | Low — legitimate users rarely have their session refreshed from multiple ASNs and geographies in rapid succession |
| Consider hunting for Microsoft Graph API queries searching for user attributes containing terms like 'payroll', 'hr', 'finance', or 'human resources', particularly using the axios/1.18.1 user agent | Microsoft Defender XDR GraphAPIAuditEvents or Microsoft 365 audit logs for Graph API queries | Reconnaissance | Medium — legitimate administrative tools or HR applications may query for similar user attributes |
Control Gaps
- Organizations that do not ingest non-interactive Entra ID sign-in logs will miss the recurring 8-hour token refresh pattern
- Reputation-based URL filtering may not catch the multi-stage redirect chain through legitimate Google and AWS infrastructure
- Traditional BEC detections focused on inbox rules, MFA changes, or outbound email abuse will not flag this campaign's restrained post-compromise activity
- MFA alone does not prevent AiTM session token theft; phishing-resistant MFA (FIDO2, Windows Hello for Business) is required
- Conditional Access policies that do not require managed/compliant devices allow stolen session tokens to be replayed from attacker infrastructure
Key Behavioral Indicators
- MailItemsAccessed events with Client App ID 5d661950-3475-41cd-a2c3-d671a3162bc1 AND API ID c999ed3e-27ae-4cb3-b3a2-46b056af63d3
- Microsoft Outlook client application sign-ins with Firefox 131.0, Firefox 151.0, or Python Requests user agents instead of Edge
- Sign-in error code 90014 on appDisplayName 'OfficeHome' first-party applications
- Single SessionID spanning multiple ASNs and geographic locations within short timeframes
- Sign-in cadence at approximately 8-hour intervals from rotating residential proxy IP addresses
- Implausible browser/OS combinations in sign-in logs (e.g., Mobile Safari or Chrome Mobile on Windows 10)
- Microsoft Graph API queries for users with attributes containing 'payroll', 'hr', 'finance' using axios/1.18.1 user agent
- Cross-tenant MailItemsAccessed events clustering into short collection windows (e.g., 18 events across 3 tenants in 26 seconds)
- HTTP response headers 'server: openresty/1.31.1.1' and 'x-powered-by: Express' on domains impersonating Microsoft login pages
- Requests to paths containing '/st_58200519/class_identifier.php' on non-Microsoft domains
- URL patterns embedding Microsoft authentication endpoints within a non-Microsoft domain's path (e.g., msonline.domain.com/https://login.microsoftonline.com/...)
- Inbound emails with subject pattern '[Organization] :ATTN: Review messages. Ref id: [string]'
- DNS resolution of Google Ads infrastructure immediately followed by resolution of a newly registered domain (fewer than 30 days old)
False Positive Assessment
Low — The article identifies several high-fidelity detection signals, particularly the unique Client App ID and API ID pairing in MailItemsAccessed events which has no legitimate instances. Individual signals like error 90014 or anomalous user agents carry slightly higher false positive risk, but the article emphasizes correlating multiple signals across identity, session, and mailbox telemetry to achieve durable, low-false-positive detection.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. If a compromise is identified, immediately revoke all active sessions for affected accounts and rotate credentials.
- Consider re-registering MFA for affected users and auditing payroll/HR platform activity (e.g., Workday, ADP) for the full suspected dwell period, paying particular attention to direct deposit changes.
- Consider reviewing MailItemsAccessed audit logs for the unique Client App ID and API ID pairing (5d661950-3475-41cd-a2c3-d671a3162bc1 / c999ed3e-27ae-4cb3-b3a2-46b056af63d3) to scope what data was accessed.
- Consider hunting for the 8-hour session-maintenance pattern across other accounts in the environment to identify additional compromises using the same SessionID rotation technique.
Infrastructure Hardening
- Consider deploying phishing-resistant MFA methods such as FIDO2 security keys, Windows Hello for Business, or certificate-based authentication to prevent AiTM session token relay.
- Evaluate whether Conditional Access policies requiring compliant or Microsoft Entra hybrid-joined devices can be enforced; review exclusions, legacy authentication paths, and application coverage for consistency.
- Consider enabling Continuous Access Evaluation (CAE) in Microsoft Entra ID for near-real-time session revocation when risk conditions change.
- Ensure non-interactive Entra ID sign-in logs are enabled and ingested into your SIEM or log retention platform, as some organizations have disabled this telemetry which blinds detection of periodic token refresh activity.
- Consider blocking or alerting on HTTP responses with 'server: openresty/1.31.1.1' and 'x-powered-by: Express' on domains impersonating Microsoft login pages.
User Protection
- Consider deploying email gateway rules to flag or quarantine messages matching the voicemail lure subject pattern '[Organization] :ATTN: Review messages. Ref id: [string]'.
- Evaluate whether URL rewriting and detonation can be applied to links containing multi-layered redirects through google.com/linkredirect to adservice.google.com.ph/ddm/clk destinations.
- Consider alerting on DNS resolution of newly registered domains (fewer than 30 days old) immediately following resolution of Google Ads infrastructure.
- If supported by your email platform, consider applying external sender warnings or banners to messages impersonating internal automated notification services.
Security Awareness
- Consider incorporating voicemail-themed phishing lures into existing phishing simulation programs to help users recognize this specific tactic.
- Consider reminding employees that legitimate voicemail notifications will not require Microsoft 365 login through external portals.
- Consider training financial, HR, and payroll personnel specifically on the risk of account compromise targeting their email access, given this campaign's focus on those roles.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping7 techniques
Tactic
Initial Access
Tactic
Credential Access
Tactic
Discovery
Tactic
Collection
Tactic
Command and Control
Additional IOCs
- File Paths:
/st_58200519/class_identifier.php- Fingerprinting endpoint on AiTM proxy domains; collects browser environment data including OS, screen dimensions, WebGL vendor, WebDriver status, and hardware concurrency
- Other:
5d661950-3475-41cd-a2c3-d671a3162bc1- Microsoft Outlook Client App ID observed in MailItemsAccessed events; when paired with API ID c999ed3e-27ae-4cb3-b3a2-46b056af63d3, this combination is uniquely associated with campaign mailbox collection activity and does not appear in legitimate Outlook accessc999ed3e-27ae-4cb3-b3a2-46b056af63d3- Undocumented Microsoft API ID observed in MailItemsAccessed events; paired with Client App ID 5d661950-3475-41cd-a2c3-d671a3162bc1, this combination is a high-fidelity indicator of campaign mailbox collection
