Payroll Pirates: How AitM Phishing Beats MFA to Hunt Finance Mailboxes

In the realm of cybersecurity, phishing campaigns continuously evolve, finding innovative ways to breach even the most secure systems. The "Payroll Pirates" adversary-in-the-middle (AitM) phishing campaign represents a significant threat, especially to finance-related email boxes. This article explores the techniques used in this campaign and offers practical guidance for detection and defense.

What is the Payroll Pirates campaign?

The Payroll Pirates campaign is a sophisticated attack vector that has attracted the attention of cybersecurity professionals globally. It specifically targets Microsoft 365 (M365) accounts, bypassing multi-factor authentication (MFA) and enabling attackers to infiltrate finance and payroll email boxes. According to Arctic Wolf Labs, this campaign has tactical overlaps with Microsoft's Storm-2755 cluster.

How does adversary-in-the-middle phishing bypass MFA?

Traditional phishing attacks are often blocked or mitigated by MFA. However, AitM phishing cleverly circumvents this layer of security. By acting as a middleman, the phishing kit intercepts the authentication tokens generated during MFA verification, granting attackers access to protected accounts.

What does the attack chain look like from lure to compromised session?

It begins with a voicemail-themed phishing email, enticing the victim with an authentic-looking "OPEN [Organisation] VOICEMAIL PORTAL" button. Upon clicking, victims encounter a multi-stage redirect chain utilizing Google Meet, Google Ads, and AWS S3 infrastructure. These redirects camouflage the real intent of the phishing attempt.

The AitM proxy relays real Microsoft login pages, giving victims a false sense of security. Meanwhile, attackers intercept the session material, which could be used to gain unauthorized access to valuable email boxes.

Why residential proxies, and why the eight-hour session refresh?

Residential proxies are used to mask the origin of the login attempts, bypassing impossible-travel and reputation controls. The attackers refresh sessions every eight hours to evade detection and keep their access consistent, with automatic changes in IP address, ASN, and geographical location.

Why do attackers target payroll and finance mailboxes specifically?

These mailboxes are goldmines for attackers, containing sensitive financial information that can be manipulated for direct financial gain, such as rerouting salary payments or stealing banking credentials.

How can organisations detect and defend against this playbook?

Implementing phishing-resistant authentication and stringent session anomaly detection are fundamental. Key signals such as suspicious OfficeHome sign-ins or unusual device/browser combinations should be actively monitored.

Defence Strategies

• Employ external monitoring services to detect lookalike domains.
• Integrate conditional access policies that restrict session activities based on risk assessments.
• Regularly audit network traffic for unusual patterns or compromised credentials.

The EASM/Brand Angle

Organisations should continuously monitor for newly registered domains that impersonate their login pages. Early detection through Brand and DNS monitoring helps mitigate potential phishing lures.

Summary

The Payroll Pirates campaign is a stark reminder that cybersecurity requires constant vigilance, adaptation, and awareness. Recognising and responding to these phishing tactics can significantly reduce the risk of financial loss and reputational damage.

FAQs

What is Payroll Pirates / Storm-2755?

Payroll Pirates is known for its cunning phishing techniques that target finance-related email boxes, often bypassing conventional MFA defenses.

Can AitM phishing really bypass MFA?

Yes, it intercepts the MFA tokens, allowing attackers undetected access to accounts.

What are the signs of a compromised Microsoft 365 session?

Signs include suspicious sign-ins, odd geographical login origins, and errors such as authentication error 90014.

What is a residential proxy and why do attackers use them?

Residential proxies mask the attacker’s origin, making it harder to trace the source of login attempts.

Who is being targeted by this campaign?

Organizations across sectors like healthcare, education, manufacturing, and government are key targets, particularly in North America and Europe.

How do organisations stop AitM phishing?

Employing a robust combination of authentication methods, anomaly detection, and using external services to continuously monitor potential exploits is essential.

Publishing and promoting awareness of phishing methods like Payroll Pirates is vital for cybersecurity resilience.