➤Summary
Payroll attacks are evolving beyond traditional business email compromise. A new campaign tracked as Microsoft’s “Payroll Pirates” cluster, also known as Storm-2755, shows how attackers can compromise Microsoft 365 accounts and then use Microsoft Graph to identify employees involved in payroll, finance, HR, benefits, invoices, and banking workflows.
The campaign begins with convincing phishing emails and adversary-in-the-middle (AiTM) infrastructure. After stealing authentication session material, attackers can maintain access while conducting reconnaissance inside the compromised Microsoft 365 environment. They then target the people and communications most likely to provide financial value. 🔐
This incident demonstrates why organizations need more than endpoint security and conventional email filtering. Strong identity controls must be combined with phishing domain detection, typosquatting detection, employee awareness, and continuous visibility across the external attack surface.
For security leaders, the lesson is straightforward: a compromised employee account can become a roadmap to an organization’s most financially sensitive personnel and information.
What Are Payroll Pirates and Why Are They Dangerous?
Microsoft’s Payroll Pirates activity illustrates a modern account-compromise model in which attackers first obtain access to a Microsoft 365 identity and then use legitimate cloud capabilities for reconnaissance. GBHackers reports that the campaign overlaps with activity tracked by Microsoft as Storm-2755 and has targeted organizations across sectors including healthcare, education, manufacturing, government, and professional services.
Rather than immediately changing passwords, creating forwarding rules, or launching obvious phishing emails, the attackers reportedly maintain a lower profile. This makes the intrusion harder to identify through traditional business email compromise indicators.
The campaign reportedly uses voicemail-themed phishing messages that impersonate Microsoft notifications. Victims are encouraged to open a supposed voicemail portal, which leads through several redirects before reaching attacker-controlled AiTM infrastructure.
The approach is particularly dangerous because the victim may see a familiar Microsoft authentication experience. The malicious proxy operates between the user and the legitimate authentication service, allowing attackers to capture authentication artifacts and session information. ⚠️
How Attackers Turn One Compromised Account Into a Target Map
The most important development occurs after the initial account takeover.
According to the reported investigation, attackers wait roughly 11 to 24 hours after initial access before refreshing stolen sessions at regular intervals. These sessions may retain the same SessionID while appearing from changing IP addresses, autonomous systems, and geographic locations.
Attackers then pivot to Microsoft Graph for reconnaissance. They enumerate users associated with functions such as:
- Payroll
- Finance
- Human resources
- Benefits administration
- Payments
- Banking
- Invoicing
- Administrative operations
Microsoft Graph is a legitimate platform API, which makes this behavior especially challenging. Microsoft documentation confirms that Graph can provide authorized applications with access to user information and Outlook mail data, depending on the permissions granted.
This means the threat is not necessarily about exploiting a software vulnerability. Instead, attackers can abuse legitimate cloud functionality after obtaining the required access.
That distinction is critical for modern security operations.
Why HR and Finance Employees Are High-Value Targets
Why would attackers spend time identifying HR and finance employees?
Because these departments frequently control information and workflows directly connected to money.
Payroll teams may handle salary records, bank details, employee identities, tax information, and payment schedules. Finance teams may manage invoices, vendor payments, banking instructions, and financial approvals. HR departments can also possess sensitive employee information that attackers can use for social engineering.
Once these personnel are identified, attackers have a much clearer picture of who to impersonate or whose mailbox communications deserve closer attention. 💰
The result is a highly targeted attack path:
- Compromise an employee through phishing.
- Capture authentication or session information.
- Maintain access without creating obvious administrative changes.
- Enumerate organizational users.
- Identify payroll, finance, HR, and payment personnel.
- Search relevant mailbox communications.
- Use the intelligence for fraud, further compromise, or targeted social engineering.
This is why identity security and domain security cannot be treated as separate problems.
The Role of Domain Spoofing Protection in Payroll Security
The first stage of this campaign demonstrates how convincing fraudulent infrastructure can facilitate account compromise. Attackers reportedly used Microsoft-themed phishing messages and attacker-controlled AiTM domains after a chain of redirects.
This is where domain spoofing protection becomes an important defensive layer.
Organizations should continuously monitor for domains that imitate their corporate identity, Microsoft-related login workflows, employee portals, payroll systems, or other trusted services. Lookalike domains can be registered specifically to support phishing campaigns or can remain dormant until attackers are ready to activate them.
Effective domain spoofing protection can help security teams discover:
- Newly registered lookalike domains
- Typosquatting variations
- Fake login portals
- Brand impersonation websites
- Suspicious DNS changes
- Fraudulent SSL certificates
- Phishing infrastructure
- Unauthorized use of company logos and branding
SpoofGuard’s platform describes real-time monitoring of domain registrations, DNS changes, SSL certificates, website content, and other threat indicators.
For organizations looking to strengthen this layer, explore SpoofGuard’s domain threat intelligence platform.
Phishing Domain Detection Can Stop the Attack Earlier
The Payroll Pirates campaign reinforces a key security principle: detection should begin before an attacker reaches the employee’s credentials.
Phishing domain detection helps organizations identify fraudulent infrastructure that attempts to imitate trusted brands, authentication portals, employee services, and corporate websites.
Attackers do not always need a technically sophisticated exploit. A convincing domain combined with an urgent message can be enough to persuade an employee to authenticate.
This is why phishing domain detection should operate continuously rather than only during an active incident.
Security teams should monitor newly registered domains and analyze whether they contain:
- Brand-name variations
- Misspellings
- Additional words such as “login,” “secure,” “portal,” or “verify”
- Lookalike characters
- Suspicious subdomains
- Replicated corporate branding
SpoofGuard also describes automated detection of phishing sites and look-alike domains as part of its brand protection capabilities.
For organizations managing numerous domains and brands, automation can reduce the workload associated with manually reviewing suspicious registrations.
Typosquatting Detection Adds Another Defensive Layer
Typosquatting remains one of the simplest ways for attackers to create convincing phishing infrastructure. A fraudulent domain may differ from the legitimate domain by only one character, a missing letter, an additional character, or a visually similar symbol.
That makes typosquatting detection especially important for organizations whose employees regularly interact with external websites, cloud applications, vendors, and payment portals.
Attackers can use these domains to imitate:
- Microsoft 365 login pages
- Payroll platforms
- HR portals
- Banking services
- Vendor payment systems
- Internal employee portals
- Corporate websites
Modern typosquatting detection should therefore consider more than basic spelling mistakes. It should examine domain permutations, DNS information, certificates, page content, hosting infrastructure, and other signals.
SpoofGuard states that its platform uses more than 45 permutation algorithms and monitors look-alike domains across multiple threat vectors.
Microsoft Graph Makes Post-Compromise Reconnaissance Easier
The abuse of Microsoft Graph is another important lesson for defenders.
Microsoft Graph provides legitimate access to resources such as users, mailboxes, calendars, and other Microsoft 365 data when appropriate permissions have been granted. Microsoft explicitly recommends using the least-privileged permissions necessary for applications.
For example, Microsoft’s documentation shows that applications can retrieve user objects when they have appropriate directory permissions, while mail APIs can provide authorized access to Outlook mailbox data.
This creates an important security challenge: legitimate API traffic can become suspicious when it occurs in an abnormal behavioral context.
Security teams should correlate:
- Entra ID authentication events
- Session reuse
- Unusual geographic changes
- Residential proxy activity
- Unexpected user agents
- Microsoft Graph reconnaissance
- MailItemsAccessed events
- Access to payroll and finance-related communications
GBHackers reports that investigators observed suspicious Graph reconnaissance activity and subsequent mailbox access involving payroll, invoices, payments, banking, benefits, and internal documentation.
The strongest detection strategy is therefore behavioral correlation rather than relying on a single malicious IP address or domain.
How External Asset Monitoring Complements Identity Security
Identity security protects accounts. External asset monitoring helps organizations understand what attackers can see and abuse outside the corporate perimeter.
This includes domains, subdomains, cloud-hosted assets, certificates, exposed services, brand references, and other internet-facing infrastructure.
The connection matters because an attack can cross multiple security layers.
For example:
Fake domain → phishing message → stolen session → Microsoft 365 access → Graph reconnaissance → HR/finance targeting → financial fraud
Each stage produces different indicators.
External asset monitoring can help organizations identify the infrastructure used during the early stages, while identity telemetry and cloud security controls help detect activity after compromise.
A mature security program should connect these signals rather than treating them as isolated alerts. 🔎
Can Domain Monitoring Prevent Payroll Fraud?
Yes, but it should be viewed as an early-warning layer rather than a complete security solution.
Domain monitoring can identify suspicious infrastructure before or during a phishing campaign, giving security teams an opportunity to investigate and potentially request a takedown.
However, organizations should combine domain intelligence with MFA-resistant authentication, identity monitoring, conditional access, mailbox auditing, employee education, and incident response.
The best defense is layered.
For example, phishing domain detection can identify malicious infrastructure, while typosquatting detection can uncover lookalike domains that traditional blocklists may miss. Identity monitoring can then identify suspicious authentication behavior if an employee is successfully deceived.
Organizations can also investigate whether exposed credentials or employee information are appearing in underground channels through a real-time dark web monitoring solution. This provides another source of intelligence when assessing potential account-compromise risk.
Practical Payroll Security Checklist
Security teams can use the following checklist to reduce exposure to attacks similar to Payroll Pirates: 🛡️
Domain and brand protection
- Monitor newly registered domains resembling corporate brands.
- Enable domain spoofing protection.
- Implement phishing domain detection.
- Use typosquatting detection for high-value domains.
- Investigate suspicious websites and certificates.
Identity security - Monitor unusual Entra ID sign-ins.
- Investigate session reuse across unexpected locations.
- Review suspicious OAuth activity.
- Apply least-privilege Graph permissions.
- Audit third-party application consent.
Mailbox security - Monitor unusual MailItemsAccessed activity.
- Investigate unexpected access to finance and payroll messages.
- Review mailbox permissions.
- Alert on unusual automated API activity.
Human security - Conduct phishing simulations.
- Train HR and finance teams on targeted impersonation.
- Incorporate Human Risk Management into security programs.
- Teach employees to verify authentication URLs before signing in.
External visibility - Maintain an inventory of public-facing domains.
- Use external asset monitoring to identify unauthorized infrastructure.
- Investigate brand impersonation quickly.
- Establish a documented takedown process.
Organizations can also use an AI URL scanner to help analyze suspicious links and prioritize potentially malicious websites during investigations.
Building a Brand Protection Strategy for Enterprises
For larger organizations, monitoring a single corporate domain is rarely sufficient. Enterprises often manage multiple brands, regional websites, subsidiaries, products, and employee-facing services.
That creates a much larger digital footprint for attackers to imitate.
A comprehensive brand protection solution for enterprises should combine domain discovery, automated permutation analysis, phishing detection, DNS monitoring, website analysis, risk scoring, and response workflows.
SpoofGuard reports capabilities including look-alike domain discovery, AI-powered risk scoring, real-time monitoring, and automated takedown workflows.
The objective is not simply to find fake domains. It is to understand which domains represent an active threat and determine how quickly the organization needs to respond.
7 Key Lessons From the Payroll Pirates Campaign
The incident offers seven practical lessons for CISOs and security teams:
- Phishing remains a major entry point. Sophisticated infrastructure does not eliminate the human element.
- MFA is not invulnerable. AiTM attacks can capture authentication session material even when users complete legitimate MFA flows.
- Cloud APIs can become reconnaissance tools. Legitimate services such as Microsoft Graph can be abused after account compromise.
- HR and finance deserve additional protection. These departments are directly connected to sensitive information and financial workflows.
- Behavior matters more than individual indicators. Multiple weak signals can reveal a much stronger attack pattern.
- Domain intelligence belongs in the SOC. Fake domains can be the first visible sign of a broader campaign.
- Early detection reduces downstream risk. Finding impersonation infrastructure before employees interact with it can interrupt the attack chain.
Final Thoughts: Protect the Attack Surface Before Attackers Map It
The Payroll Pirates campaign demonstrates how modern attackers can turn one compromised Microsoft 365 account into an intelligence source for targeting an organization’s most valuable employees. Rather than immediately causing disruption, attackers can quietly map HR, payroll, finance, and payment functions before accessing sensitive communications.
That makes proactive security essential.
Organizations need strong identity controls, cloud monitoring, employee security awareness, phishing defenses, and domain intelligence working together. Domain spoofing protection can help identify fraudulent infrastructure before it becomes a successful credential-theft campaign, while phishing domain detection and typosquatting detection provide additional visibility into brand impersonation.
The broader objective is to protect company from spoofed domains before those domains become part of a larger attack chain.
Discover much more in our complete guide
Request a demo NOW
Disclaimer: Spoofguard reports on publicly available threat-intelligence sources. Inclusion of an organization in an article does not imply confirmed compromise. All claims are attributed to external sources unless explicitly verified.