Payroll Pirates: Strange New Tides in Business Email Compromise

Arctic Wolf documents an active, large-scale voicemail-themed AiTM phishing campaign that proxies legitimate Microsoft 365 authentication (including MFA) to capture tokens, then quietly maintains and refreshes stolen sessions using rotating residential proxies to enumerate and exfiltrate mailbox content—particularly targeting payroll, HR, and finance workflows—across multiple sectors and regions; the report includes technical indicators, detection signals (e.g., error 90014, MailItemsAccessed AppID/API pairing, eight-hour token-refresh cadence), and remediation guidance.