Executive Summary
Storm-2755 is a financially motivated threat actor disclosed by Microsoft in April 2026, conducting precision fraud operations against Canadian employees with the objective of redirecting salary payments to attacker-controlled bank accounts. The group’s defining characteristic is a fully malware-free operational model: Storm-2755 does not install implants, does not use traditional C2 infrastructure, and does not need to bypass endpoint detection tools. Instead, they steal authenticated web sessions through adversary-in-the-middle phishing, then use those sessions to impersonate the legitimate user within HR and payroll self-service portals to change direct deposit banking details.
The attack is operationally efficient and difficult to detect using traditional security controls. MFA is bypassed because the attacker presents a stolen, valid, MFA-verified session token — the authentication event completed legitimately before the session was captured. The fraud discovery window is typically the next pay cycle, when the victim notices their salary did not arrive. By that point, the attacker’s banking account has often already transferred funds out.
Threat Actor Profile
Storm-2755 is assessed as a financially motivated criminal actor. Microsoft assigned the Storm- designation cluster reflecting an emerging or evolving actor with limited attribution confidence at the time of initial disclosure. The group’s geographic focus — exclusive targeting of Canadian employees — suggests either a operational decision to avoid US law enforcement attention (US cyber fraud investigations carry more aggressive prosecution risk), or familiarity with Canadian HR systems and employment law that gives the group operational edge in that environment.
The group’s malware-free approach is a deliberate counter-detection choice. Endpoint detection and response platforms, antivirus, and network monitoring tools are substantially less effective against actors who exclusively use legitimate web browsing behaviour and stolen credentials. From a telemetry perspective, Storm-2755 intrusions look like an employee logging into their HR portal — because that is exactly what is happening, with the wrong person at the keyboard.
Storm-2755 emerged as a distinct tracked cluster in early 2026. The group’s TTPs overlap with known Business Email Compromise operators and AiTM phishing specialists, but the specific focus on payroll diversion rather than wire transfer authorisation (the more common BEC target) and the exclusive Canadian focus are characteristics that distinguish Storm-2755 as a separate operational entity.
Technical Profile: The AiTM Payroll Fraud Kill Chain
Storm-2755 executes a five-phase kill chain that begins with a victim targeting decision and ends with automated payroll redirection.
Phase 1: Victim Identification and Initial Access Vector Selection
Storm-2755 targets employees rather than executives. The logic is economic: payroll fraud against an employee redirects one paycheck, while BEC against an executive or finance officer is higher value but harder to execute and more closely monitored. By targeting the general employee population, Storm-2755 can operate at scale — a successful campaign against a thousand employees across a hundred organisations generates substantial fraudulent income from individually small transactions.
Initial access vector selection involves:
- SEO poisoning targeting searches for HR portal login pages, employee self-service portals, and payroll systems (Workday, ADP, Ceridian/Dayforce, Paylocity). Storm-2755 creates lookalike pages that appear in search results for these queries.
- Malvertising through paid search, placing trojanised login page links above organic results for HR portal search terms
- Phishing email campaigns targeting employees with HR-themed lures (pay stub notifications, W-2 availability, benefits open enrollment)
Phase 2: AiTM Session Capture
Storm-2755’s technical core is an adversary-in-the-middle phishing infrastructure that functions as a reverse proxy between the victim and their legitimate HR portal. When a victim navigates to a Storm-2755 controlled page, they are proxied to the real HR portal:
- The victim sees what appears to be the real login page (it is the real login page, rendered through the proxy)
- The victim enters credentials and completes MFA (which the proxy forwards to the real portal)
- The real portal issues a session cookie and redirects the victim — but Storm-2755’s proxy captures the session cookie before forwarding the response
- The victim is then either silently redirected to the real portal (continuing their session normally, unaware of the interception) or presented with an error
The captured session cookie provides authenticated access to the HR portal with the full permissions of the victim’s account, bypassing MFA because the MFA challenge completed during the proxied authentication. The session remains valid for as long as the portal’s session timeout — typically hours to days.
Phase 3: CVE-2025-27152 as an Optional Enabler
Microsoft’s investigation identified exploitation of CVE-2025-27152, a server-side request forgery vulnerability in the Axios HTTP client library (versions 0.8.1 to 1.7.3), in a subset of Storm-2755 operations. The Axios vulnerability allows an attacker to cause an application making outbound requests via Axios to redirect those requests to attacker-controlled infrastructure through manipulation of the protocol handler.
In the Storm-2755 context, CVE-2025-27152 was used to extract session tokens from web applications relying on Axios for API calls — converting what would otherwise require social engineering to a technical session theft path. The vulnerability does not affect all HR platforms, but many modern HR self-service portals use JavaScript frameworks with Axios dependencies for API communication.
The Axios vector is not the group’s primary method — the AiTM phishing infrastructure is the high-volume approach — but it represents a technical escalation in Storm-2755 capability that extends the attack surface beyond phishing-susceptible users.
Phase 4: Direct Deposit Modification
With a valid session, Storm-2755 accesses the payroll or HR self-service portal and modifies the victim’s direct deposit banking information. Most HR platforms allow employees to update their banking details through a self-service interface — this is the intended functionality for when employees change banks. Storm-2755 exploits it by substituting the attacker’s account for the victim’s legitimate account.
The modification may be:
- A complete replacement of the victim’s bank account with the attacker’s
- A partial split that redirects a portion of the paycheck to the attacker’s account while allowing the remainder to reach the legitimate account — reducing the per-incident dollar value but potentially extending the time before detection
Many organisations do not have automated monitoring for bank account changes in HR systems, and the change does not affect any observable employee-facing functionality until the next pay cycle.
Phase 5: Fraud Realisation and Exfiltration
Payroll fraud proceeds on the next scheduled pay date. The salary transfer goes to the attacker’s account. Attacker-controlled accounts used in payroll fraud are typically temporary — money mule accounts that receive funds and rapidly transfer them out through layered transactions. By the time the victim reports that their salary did not arrive and the organisation reverses the fraudulent banking change, the funds have moved to accounts that are harder to trace or freeze.
Recovery of stolen funds is possible but not guaranteed. The specific timeline between the fraudulent deposit and the money mule account clearing the funds determines whether a bank freeze or reversal can succeed.
Targeting Profile
Storm-2755’s exclusive focus on Canadian organisations represents a deliberate geographic scope decision. Within Canada, the group does not appear to specialise by sector — the value extraction is independent of the victim industry, because the target in every case is the employee payroll process, not sector-specific data or access. Confirmed targeting spans financial services, healthcare, professional services, government contractors, and technology companies.
The employee population targeted within those organisations tends toward:
- Employees with high annual salaries (maximising single-incident fraud value)
- Employees who have recently started or who have documented salary changes (reducing suspicion from a bank account change event)
- Employees in roles that regularly use HR self-service portals (reducing the phishing anomaly signal)
The group’s campaign tempo appears to be event-driven — SEO poisoning and malvertising campaigns peak around dates when employees are likely to access HR portals (benefits open enrollment periods, W-2 distribution season, performance review cycles). This timing awareness suggests operational familiarity with the Canadian employment calendar.
Historical Incidents and Impact
Storm-2755 was tracked internally by Microsoft before the April 2026 disclosure, based on the distinctive combination of Canadian geography, AiTM methodology, and payroll-specific fraud objectives. The April 2026 disclosure followed an investigation triggered by multiple victim reports from Canadian enterprises that had experienced payroll fraud without evidence of traditional malware infection.
Microsoft’s disclosed investigation identified victims across multiple provinces and multiple sectors, suggesting a campaign that had been running for months before attribution. The total financial impact across confirmed victims was not publicly disclosed, but payroll fraud at scale — when successful across an employee population in the hundreds — can generate hundreds of thousands of dollars per pay cycle.
The malware-free operational model means that many organisations affected by Storm-2755 likely attributed the fraud to insider threat or user error rather than external compromise, underreporting the true scope of the campaign.
Defensive Implications
Authentication controls
Standard MFA does not defend against AiTM session theft if the session token is captured after authentication. Phishing-resistant authentication — FIDO2 hardware tokens or passkeys — provides the strongest protection because the credential is bound to the origin domain, and the AiTM proxy’s domain is not the legitimate HR portal domain. FIDO2/passkey authentication will fail against a proxied login page.
For organisations that cannot deploy phishing-resistant MFA immediately, continuous access evaluation — re-challenging the session with additional factors based on risk signals — reduces the window of fraudulent access from session theft.
HR/payroll portal controls
Most HR platforms provide access to reports on recent banking detail changes. Organisations should:
- Enable notifications or alerts for any banking information change in the HR system, sent to both the employee’s work email and a registered secondary channel (mobile number, personal email captured during onboarding)
- Require re-authentication for banking detail changes — some HR platforms allow a step-up authentication requirement specifically for this operation
- Implement a delay between banking detail change and that account becoming effective for payroll distribution (48-72 hours gives the window to catch fraudulent changes before a pay cycle executes)
- Review HR portal access logs for the period preceding any discovered fraudulent banking change — look for access from IP addresses that don’t match the employee’s typical access patterns, particularly residential proxy IPs
Fraud detection
The money mule account receiving fraudulent payroll deposits will often fail simple bank-side KYC checks if examined — newly opened accounts, accounts with no transaction history, or accounts registered to addresses inconsistent with an employee relationship. Close bank partnerships and direct reporting of suspected fraud accounts accelerates the freeze window.
Payroll reversal timelines are established by banking regulations — in Canada, same-day ACH reversal is possible within specific windows. Finance and HR teams should be briefed on the reversal process before an incident requires executing it under time pressure.
Threat intelligence integration
Storm-2755 infrastructure — phishing domains, proxy infrastructure, and money mule account patterns — should be tracked and shared across the Canadian financial and HR system ecosystem. Industry sharing groups for Canadian financial institutions have existing channels for exactly this type of fraud intelligence, and Storm-2755’s operational pattern (event-driven campaigns targeting HR portal access periods) means that advance intelligence about SEO poisoning campaigns can allow blocklisting before the campaign peaks.
Assessment
Storm-2755 represents an increasingly common threat pattern: a financially motivated actor that has deliberately engineered their operational model to be invisible to conventional security controls. No malware means no endpoint detection hits. Stolen sessions mean no authentication anomalies. Banking changes through legitimate HR portal functionality mean no privilege escalation or lateral movement events.
The group’s current Canadian geographic focus may not be permanent. If Storm-2755’s operational model proves stable — which the absence of disruption through the apparent active campaign period suggests — expansion to US, UK, or Australian targets operating similar HR self-service platforms would be a logical progression. The Canadian focus may reflect the group’s familiarity with Canadian employment law and bank account structures, but the technical attack chain works wherever employee self-service HR portals exist.
Organisations with Canadian employees or payroll processing should treat Storm-2755 as an active threat relevant to their environment today.