Payroll Pirates Phishing Campaign Targets Microsoft 365 Financial Workflows (Campaign)

Payroll Pirates is a phishing campaign that impersonates voicemail notifications and uses multi-stage redirects through legitimate services (Google Meet, Google Ads, Amazon S3) to land victims on an attacker-controlled AiTM proxy that relays Microsoft authentication and captures session tokens without stealing passwords. The actors fingerprint and geolocate victims, refresh stolen sessions every ~8 hours using residential proxies, and use Microsoft Graph to enumerate payroll, HR, finance, and admin accounts to quietly collect mailbox contents related to invoices, payroll, banking, and financial operations, with occasional use of malicious inbox rules to hide messages.