Critical Microsoft Graph Flaw Lets Attackers Target HR, Payroll Staff

Key Takeaways

• A sophisticated phishing campaign is actively targeting HR and payroll staff across various industries globally.
• Attackers are bypassing multi-factor authentication (MFA) by stealing active session tokens via adversary-in-the-middle (AiTM) phishing.
• The threat actors leverage Microsoft Graph API for rapid reconnaissance, identifying key personnel for financial fraud, specifically payroll redirection.
• The campaign, tracked by Microsoft as Storm-2755 and Storm-2657, leaves no endpoint malware, making traditional detection methods ineffective.
• Organizations must implement phishing-resistant MFA, enable Microsoft Graph activity logging, and enforce robust conditional access policies to mitigate risks.

Attackers Exploit Microsoft Graph for Covert Payroll Targeting

Cybersecurity researchers have uncovered an escalating campaign where threat actors are exploiting legitimate Microsoft cloud services to conduct stealthy reconnaissance. The primary targets are human resources and payroll personnel within corporate networks, with the ultimate goal of rerouting employee salaries to accounts under attacker control. This campaign demonstrates a concerning trend of leveraging native cloud tools to bypass conventional security measures, according to a recent report by Security Risk Advisors (SRA) and BushidoToken Threat Intel.

The attack methodology is particularly insidious due to its “clean” nature. Instead of deploying malware or exploiting software vulnerabilities, the attackers initiate the compromise by stealing active user session tokens. This is achieved through sophisticated adversary-in-the-middle (AiTM) phishing pages that intercept user credentials and session cookies as victims attempt to log into a fake Microsoft 365 portal. The stolen session token then allows attackers to completely bypass multi-factor authentication (MFA), gaining unauthorized access to the user’s account without requiring their password.

A critical aspect of this campaign is its ability to evade endpoint detection and response (EDR) solutions. Since no malware is planted on endpoints, traditional security tools have virtually no footprint to detect or alert on, as highlighted in the SRA and BushidoToken Threat Intel report. This “living off the land” approach, utilizing legitimate tools, blurs the line between normal network activity and active intrusion, making detection exceptionally challenging.

Microsoft Graph API Abused for Targeted Reconnaissance

Once inside a compromised Microsoft 365 account, attackers pivot to the Microsoft Graph API, a powerful and legitimate developer interface used for querying directory information and interacting with various Microsoft services. They exploit this API to perform bulk queries, efficiently scanning an organization’s directory for users whose job titles or display names contain keywords such as “payroll,” “hr,” “human,” “resources,” “finance,” and “admin.” This rapid directory enumeration can be completed in minutes, yielding a precise list of high-value targets for subsequent financial fraud.

The observed Graph queries were remarkably consistent across compromised environments. Attackers typically began by pulling all user accounts using the /v1.0/users?$top=999 endpoint. They then applied chained search filters across fields like displayName, jobTitle, mail, and userPrincipalName, paginating results with $skiptoken to ensure comprehensive data harvesting. The tokens used for this enumeration often carried broad delegated permissions, including Directory.Read.All, Files.ReadWrite.All, Group.ReadWrite.All, Chat.ReadWrite, and User.ReadWrite. This extensive access goes beyond simple directory lookups, increasing the risk of attackers establishing persistent access through OAuth-based consented applications, which can survive password resets and token revocations.

This campaign, linked to clusters Microsoft identifies as Storm-2755 and Storm-2657, has been observed impacting organizations across diverse sectors, including healthcare, food services, and manufacturing. In every instance, the ultimate objective remains consistent: to redirect an employee’s direct deposit. This is typically achieved by either directly contacting HR departments or by altering settings within HR platforms like Workday, often after gaining access to the targeted employee’s account.

Attack Infrastructure and Persistence

Analysis of authentication traffic revealed a tactical use of proxy infrastructure. Initial authentication attempts originated from US mobile carrier IP ranges, while the subsequent Graph enumeration traffic was traced back to Canadian residential ISPs. This split in geographic origin is consistent with the use of residential proxy networks designed to mask the attackers’ true location and operational footprint. Furthermore, researchers noted that unremediated compromised accounts continued to generate non-interactive sign-ins to Office 365 Exchange Online approximately every three hours. These persistent access attempts utilized a Firefox 131.0 user-agent and rotated token identifiers with each session, indicating that attackers maintained long-term access post-initial compromise.

What You Should Do

• Enable Microsoft Graph Activity Logging: This is the most critical step. Forward these logs to a SIEM or security data lake for continuous monitoring and anomaly detection, as endpoint detection is ineffective.
• Deploy Phishing-Resistant MFA: Implement FIDO2 security keys, Windows Hello for Business, or certificate-based authentication. Traditional MFA methods like authenticator app push notifications and SMS codes are vulnerable to AiTM token theft.
• Configure Conditional Access Policies: Enforce policies that require compliant or hybrid-joined devices for access. Enable continuous access evaluation to revoke replayed tokens in near real-time.
• Thoroughly Remediate Compromised Accounts: If an account is compromised, immediately revoke all sessions and refresh tokens via the Entra Admin Center. Reset credentials, re-register MFA methods, and audit all enterprise application consent grants.
• Verify Payroll Changes: HR teams must treat all direct deposit or payroll change requests as suspect. Verify such requests through an out-of-band channel (e.g., a direct phone call to a known number) before processing. Review and reverse any payroll changes made during the compromise window.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.