Your MFA Won’t Save You From This One

I came across a piece of research a few days ago that made me stop scrolling and actually read the whole thing twice. Arctic Wolf Labs published details on a phishing campaign that’s currently active against Microsoft 365 accounts, and after ten plus years of doing this work, it’s not often something makes me want to rewrite part of my client checklist. This one did.

Here’s the short version of why it matters.

Most phishing still works the old way. Fake login page, you type your password, attacker has your password. Annoying, but detectable, and MFA usually kills it dead.

This one skips that step entirely. The attacker sits in the middle of your actual login to Microsoft, in real time, and relays everything back and forth so it looks completely normal from your end. You type your password. You approve your MFA prompt. Nothing looks off because technically, nothing is off, you really are logging into Microsoft. The catch is the attacker is watching the whole exchange and walks away with your session token at the end of it. And a session token doesn’t ask for a password again. It’s already past that door.

So when I say MFA doesn’t stop this, I mean it literally. Not “MFA helps but isn’t perfect.” I mean the standard push notification MFA most businesses use does nothing here, because authentication already happened successfully before the attacker takes anything.

Here’s how they actually get you to that fake login without tripping a single filter. The link doesn’t go straight to a phishing page. It routes you through six hops, starting with a Google Meet link, then a Google redirect, then a Google Ads click tracker, then an AWS S3 page, before finally landing on the AiTM redirector and the fake authentication proxy. Every domain along the way, until the very end, is one you already trust. That’s the whole point. Email filters and quick glances both wave it through because it looks like Google and Amazon infrastructure right up until the last two hops. Along the way the page also fingerprints your browser, OS, screen size, timezone, and a few other details, then uses that to route you to the right fake login experience for your setup.

What happens after they get in is honestly the part that bothers me more.

They’re not smashing and grabbing. They’re patient. The sessions get refreshed roughly every eight hours using rotating residential proxies, so instead of one obvious login from a weird country, it just looks like normal ongoing activity from different but plausible locations. In most cases, the attackers don’t touch anything that would leave a trail. No MFA changes, no new devices registered, no credential resets. They just sit there reading mail, specifically digging through payroll, HR, and finance mailboxes for invoices, bank details, and benefits info. In a handful of cases they went a step further and created inbox rules to quietly move certain emails to Deleted Items and mark them read. But the fact that most of them didn’t even need to do that is what makes this one hard to catch. There’s often no red flag to trip.

Microsoft’s already tracking a piece of this under the name Storm-2755, some people call it Payroll Pirates.

Now, what actually stops it, because that’s the part people actually need.

Regular MFA won’t cut it, I already said that. What does work is phishing resistant MFA, meaning FIDO2 security keys or Windows Hello for Business. Those tie the login to a physical device, which breaks the whole relay trick this attack depends on.

If you’re on Microsoft 365 with Conditional Access, turning on token protection matters here too. It ties a session to the device it was issued on so even a stolen session token can’t just get reused somewhere else.

I’d also tell anyone running a business to keep an eye on inbox rule creation, especially on payroll and finance mailboxes. A new rule quietly archiving or marking messages as read is one of the clearest red flags there is, and almost nobody checks for it.

And honestly, the simplest fix costs nothing. If a payroll or banking change ever comes through email, call the person. Use a number you already know, not one from the email. That one habit alone stops a huge chunk of these from ever turning into real damage.

Attackers aren’t kicking the door in anymore. They’re walking in the front, quietly, and trying to stay as long as they can without anyone noticing. If your business is still running on push based MFA with nothing else behind it, that’s exactly the gap this kind of attack is built for.

Worth a real look, not a checkbox.