Storm-2755 Uses AiTM Hijacking to Divert Employee Salaries

Microsoft-tracked Storm-2755 is a financially motivated campaign targeting Canadian users that uses SEO poisoning and malvertising to lure victims to spoofed Microsoft 365 sign-in pages, perform AiTM session hijacking to capture passwords and session tokens, and replay those tokens (observed with the Axios 1.7.9 user-agent) to access Office/HR services and change payroll direct-deposit settings so salaries are routed to attacker accounts; recommended mitigations include immediate token revocation, forced credential/MFA resets, phishing-resistant MFA (FIDO2/WebAuthn), Conditional Access with adaptive session lifetimes, Continuous Access Evaluation, and monitoring for suspicious user‑agents and inbox rule creation.