Hackers Use AiTM Session Hijacking to Redirect Employee Salaries in New Storm

Cybersecuritynews •Tushar Subhra Dutta • April 10, 2026

A financially motivated threat group called Storm-2755 has launched a campaign that quietly reroutes employee salary payments to attacker-controlled bank accounts. Targeting Canadian workers, the group uses adversary-in-the-middle (AiTM) techniques to hijack authenticated sessions and bypass multi-factor authentication (MFA), in what researchers have labeled “payroll pirate” attacks. The campaign starts with SEO poisoning and malvertising. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Storm-2755 Targets Canadian Employees in Payroll Pirate Attacks A financially motivated threat actor known as Storm-2755 is targeting Canadian employees by hijacking their payroll accounts to redirect salary payments to attacker-controlled bank accounts. The attackers employ adversary-in-the-middle (AiTM) techniques to steal authentication tokens and session cookies through malicious Microsoft 365 sign-in pages. This method allows them to bypass multi-factor authentication (MFA) and conduct their operations without raising immediate suspicion. Victims receive phishing emails that trick human resources into updating banking information, while the attackers also manipulate inbox rules to hide critical communications. Microsoft has previously disrupted similar campaigns, indicating a growing trend in payroll-related cybercrime. The FBI reported over 24,000 business email compromise (BEC) complaints last year, highlighting the financial impact of such attacks. Microsoft advises organizations to block legacy authentication protocols and implement phishing-resistant MFA as preventive measures. 4 sources 71

Hackers Use AiTM Session Hijacking to Redirect Employee Salaries in New Storm

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)