Alert: Payroll-Hijacking Attacks Are Targeting Canadian Employees

Microsoft warns of a criminal group dubbed “Storm-2755” running payroll-pirate campaigns in Canada that use SEO poisoning/malvertising to surface malicious Microsoft 365 sign-in pages, employ adversary-in-the-middle (AiTM) techniques to capture authentication tokens and bypass legacy MFA, then socially engineer HR/finance staff (e.g., via “Question about direct deposit” emails) to change employee payment information and divert salaries.