SEO‑Poisoned Office 365 Search Results Enable Payroll Theft from Canadian Employees
What Happened – A financially‑motivated group tracked by Microsoft as Storm‑2755 poisoned search‑engine results and malicious ads for “Office 365” (including misspellings). Victims who clicked were taken to a fake Microsoft 365 login page that harvested credentials and performed an authentication‑in‑the‑middle (AiTM) attack, allowing the attackers to hijack the session, modify mailbox rules, and send fraudulent payroll‑change requests that redirected employee paychecks to attacker‑controlled accounts.
Why It Matters for TPRM –
- Credential‑theft attacks on cloud productivity suites can be leveraged to compromise downstream SaaS (e.g., Workday) and steal funds.
- The technique bypasses non‑phishing‑resistant MFA, exposing gaps in multi‑factor controls.
- Payroll‑related social engineering creates direct financial loss, a risk that extends beyond data confidentiality.
Who Is Affected – Organizations that use Microsoft 365 (or similar cloud‑based email/Collaboration platforms) and integrate with payroll or HR SaaS such as Workday, across any industry but with a notable focus on Canadian enterprises.
Recommended Actions –
- Verify that MFA solutions are phishing‑resistant (e.g., FIDO2, hardware tokens).
- Enforce strict email‑origin verification for payroll change requests (e.g., digital signatures, out‑of‑band confirmation).
- Monitor for anomalous inbox rules and unusual login locations.
- Conduct regular phishing‑simulation training that includes SEO‑poisoning scenarios.
Technical Notes – The attackers used SEO poisoning, malvertising, and a fake Microsoft 365 login page to harvest credentials. They leveraged version 1.7.9 of the Axios HTTP client to relay authentication tokens, enabling an AiTM session that bypassed MFA. Compromised mailboxes were used to search for payroll‑related keywords, create hidden inbox rules, and send spoofed HR emails. In some cases, the group directly logged into SaaS payroll platforms (e.g., Workday) to alter banking details. Source: Help Net Security