Hackers Use AiTM Session Hijacking to Redirect Employee Salaries in New Storm-2755 Campaign

Storm-2755 is running a financially motivated AiTM campaign that targets Canadian employees via SEO-poisoned search results and malvertising to capture Microsoft 365 credentials and live session tokens. The group uses a rogue domain (bluegraintours.com), relays tokens via Axios (v1.7.9) — reportedly leveraging CVE-2025-27152 — then accesses mailboxes to socially engineer HR or directly update payroll in HR platforms, renewing stolen sessions and creating inbox rules to evade detection and steal salary payments.