Payroll Pirates AiTM Phishing Hijacks Microsoft 365 Sessions and Targets Payroll Emails

Payroll Pirates are using phishing emails to seize Microsoft 365 sessions and search payroll-related mailboxes. The campaign turns a voicemail alert into a route for financial fraud, even when multi-factor authentication is enabled. The messages imitate an automated call notification and invite recipients to open a voicemail portal. A click passes through redirect services before reaching a fake sign-in page that relays the real Microsoft login process, as in the new AiTM attack campaign. Arctic Wolf analysts identified activity across healthcare, education, manufacturing, government, and professional-services organizations in North America and Europe. Redacted phishing email showing the voicemail notification lure...

Read the full article at the source.