Attackers hijacking Microsoft 365 sessions are deliberately skipping the account changes that trigger most detection rules, keeping stolen access alive for days while they read finance mailboxes.

 

What happened

An active email campaign is taking over Microsoft 365 accounts to locate employees involved in financial workflows and collect their mail, The Hacker News reported. Researchers who documented it observed hundreds of organizations targeted in a single month, with healthcare among the sectors affected alongside education, manufacturing, government, and professional services. The lure is a voicemail notification that leads to a decoy page sitting between the victim and the real Microsoft sign-in, a technique called adversary-in-the-middle, where the fake page passes everything the victim types through to the genuine service while keeping a copy. Credentials and multi-factor authentication codes both get captured that way, which leaves the attacker holding a working session rather than a password to try later. The campaign overlaps with activity Microsoft tracks under the label Storm-2755.

 

Going deeper

Reaching the decoy page takes six hops through services no filter wants to block. The chain opens with a Google Meet redirect link, moves through Google's outbound-link infrastructure and a Campaign Manager click tracker, then lands on an HTML file parked in an Amazon S3 bucket that forwards the victim to the phishing infrastructure. The page runs JavaScript to profile the visitor's browser, operating system, screen dimensions, language, time zone, and graphics hardware before passing them along, and queries a geolocation service to record which country the request came from. That country code has a purpose, since sign-ins from the attacker follow within minutes from a residential proxy in the same country, meaning traffic routed through a home internet connection rather than a data center. Conditional access rules built around unusual locations and unfamiliar hosting providers find nothing unusual to flag. Once inside, the attackers query the Microsoft Graph API, the programming interface applications use to read tenant data, to enumerate staff in payroll, HR, finance, and administrative roles before pulling messages about payments, banking, invoices, and benefits.

 

What was said

The campaign "uses residential proxies to disguise malicious sign-ins as ordinary consumer traffic," researchers wrote in findings published August 7, 2026, describing automated activity that refreshes compromised sessions at roughly eight-hour intervals. They noted that the gap between the original phishing event and the automation that follows, combined with restrained behavior afterward, makes the two harder to connect and less likely to trip existing detections.

 

In the know

What the attackers declined to do is the part worth studying. In most intrusions investigators examined, the operators changed no multi-factor authentication methods, registered no devices, modified no credentials, sent no further phishing from the compromised account, and created no inbox rules. Every one of those actions is something a detection rule watches for, and skipping all of them leaves a security team with sign-in events and nothing else. The signals that survive are subtler. Sign-in logs showed implausible pairings such as mobile browser versions on desktop Windows, sessions reporting Microsoft Outlook as the client application while carrying Firefox or Python scripting user agents, and the same session identifier persisting while the source address, network operator, and country all changed underneath it. A handful of cases did involve hands-on activity to create rules moving selected messages to Deleted Items and marking them read, which suggests human operators stepping in selectively while automation handled the rest.

 

The big picture

The attackers want payroll data, and a healthcare organization's obligations do not follow the attacker's intent. A mailbox belonging to an HR or benefits administrator at a covered entity routinely holds enrollment forms, accommodation requests, leave documentation, and correspondence with health plans, and unauthorized access to any of it starts a HIPAA breach risk assessment regardless of whether the intruder was hunting bank details. Microsoft's guidance on the related payroll diversion campaigns it has tracked since 2025 centers on phishing-resistant multi-factor authentication, which binds authentication to the genuine site address so a relayed login produces nothing the attacker can reuse. Organizations should also review whether their conditional access policies assume attackers arrive from unfamiliar addresses, since matched residential proxies defeat that assumption entirely, and whether anyone is alerting on client application and user agent mismatches in sign-in logs.

 

FAQs

What is a residential proxy and why does it defeat location-based controls?

A connection routed through a consumer internet address, often on a home router enrolled into a proxy network with or without the owner's knowledge. Security tools that flag logins from data centers, hosting providers, or foreign countries see an ordinary broadband connection in the expected location instead.

 

How can a session stay alive for days without the user noticing?

Refresh tokens issued at sign-in let an application obtain new access tokens without prompting the user again, and default lifetimes run far longer than most administrators assume. Automated refreshes at regular intervals keep the session valid until an administrator explicitly revokes it or the token lifetime policy expires it.

 

Why does the Microsoft Graph API appear in so many mailbox compromises?

It provides programmatic access to mail, calendars, files, directory information, and user attributes through one interface, so an attacker holding a valid token can enumerate an organization's staff and pull specific messages without ever opening a mailbox in a browser. Activity through it also generates different log entries than interactive access.

 

What sign-in anomalies are worth alerting on?

Client application and user agent combinations that do not match, such as a session reporting a desktop mail client while presenting a scripting library's user agent. Also worth alerting on is a single session identifier appearing from multiple network operators or countries, which no legitimate session produces.

 

Does phishing-resistant MFA prevent session theft entirely?

It prevents the initial credential capture, since authentication fails on a lookalike domain, which removes the attacker's path to a session in the first place. Tokens obtained through other means, such as malware on an already-authenticated device, remain a separate problem requiring device-bound token protection and endpoint controls.