Poisoned “Office 365” search results lead to stolen paychecks

### Executive summary Microsoft researchers uncovered Storm-2755, a financially-motivated campaign targeting Canadian employees that uses SEO poisoning, malvertising, and an AiTM proxy to capture Microsoft 365 credentials and session tokens; attackers then impersonate employees or directly access payroll SaaS to change direct-deposit details and steal paychecks. Microsoft recommends FIDO2/WebAuthn, monitoring for Axios user-agent and non-interactive periodic sign-ins, alerting on new inbox rules filtering financial keywords, and requiring out-of-band verification for payroll changes.