Storm-2755: AiTM Session Theft
| Attack type | Session theft, phishing, business email compromise |
| Threat actors | Storm-2755 ("payroll pirate") and any adversary-in-the-middle phishing kit, including phishing-as-a-service platforms |
| Coverage since | October 20, 2026 |
| Platforms | Microsoft Entra ID, Microsoft 365 |
MFA was satisfied, not bypassed. Adversary-in-the-middle (AiTM) phishing steals the session Microsoft issues after MFA succeeds. The victim signs in to genuine Microsoft pages, enters a real password and completes a real MFA challenge — through a reverse proxy that keeps the session for the attacker. Every later use of that session carries the MFA claim, and the attacker never sees another prompt.
The threat
Storm-2755 sends victims to a fake Microsoft 365 sign-in page through search ads and SEO poisoning. Once it holds a session, the actor searches the mailbox for payroll and HR content, hides replies with inbox rules, and — in one reported case — changed the victim's bank details in the payroll system.
Storm-2755 is one operator among many. AiTM is sold as a service, kits are cheap, and Microsoft has seen payment fraud start within minutes of a session being stolen.
Why it gets past defenses
- MFA does not help. Push approvals, SMS codes and one-time passwords are all phishable — the victim types or approves them, and the proxy forwards them.
- IP reputation does not help. Attackers replay stolen sessions through residential proxies: every address is a clean home internet connection, and the address changes on almost every request.
- Risk scoring does not help. Microsoft's own sign-in risk can rate every replayed sign-in as no risk at all, because each one, taken alone, looks like the user.
- Patience. Attackers often wait hours before using a session, then work it during the victim's business hours to blend in.
How Fluency catches it
Fluency watches the session, not the sign-in.
- The capture. A relaying proxy leaves a tell in the sign-in itself. Fluency flags the proxied sign-in the moment it happens — in Entra ID sign-in logs and in the Microsoft 365 audit log.
- The replay. Fluency learns each user's networks, then follows the captured session ID. When that session turns up from a network the user never had — days later or minutes later — Fluency raises a high-confidence alert. The user's own office, home and company proxy never trigger it.
- The abuse. Mail, SharePoint and OneDrive activity under the captured session from a new network is flagged as the reconnaissance stage — the point where the attacker goes looking for payroll and banking content.
- The cover-up. Inbox rules named with nothing but punctuation or a single character — a favorite trick to keep a rule from standing out — raise their own alert.
With the Fluency AiTM Module turned on, Fluency also revokes the user's sessions and tokens within seconds of catching the stolen session in use. It is available to every Fluency customer and MSSP partner; ask your Fluency team to enable it.
From the field
In a real intrusion Fluency investigated, an AiTM kit captured a session from one employee and the attacker replayed it 21 hours later from 17 home internet connections across seven US states and Canada — with zero MFA prompts. Microsoft rated every replayed sign-in as no risk. Grouped by session instead of by address, the same activity became one impossible session, and the investigation walked back from the first alert to the original capture in one timeline.
The full reconstruction — log-level timeline, hunting queries and a token-theft response playbook — is in the white paper Adversary-in-the-Middle in Practice.
Detections included
| Detection | What it catches |
|---|---|
EntraID_AiTM_Capture | The proxied sign-in in Entra ID sign-in logs. High confidence. |
Office365_AiTM_Capture | The same capture in the Microsoft 365 audit log. High confidence. |
EntraID_AiTM_Session_Replay | The captured session used from a network the user did not have. High confidence for 14 days after capture, medium up to 90. |
EntraID_AiTM_Session_Activity | Exchange, SharePoint or OneDrive activity under the captured session from a new network. High confidence. |
Office365_InboxRule_Odd_Name | Inbox rules named only with punctuation or a single character. High. |
New or changed MFA methods — how an attacker plants a second factor of their own — go on the user's timeline, so they are in front of the analyst for every one of these alerts.
MITRE ATT&CK
| Tactic | Technique |
|---|---|
| Credential Access | T1557 Adversary-in-the-Middle, T1539 Steal Web Session Cookie, T1111 Multi-Factor Authentication Interception |
| Defense Evasion, Lateral Movement | T1550.004 Use Alternate Authentication Material: Web Session Cookie |
| Collection | T1114.002 Remote Email Collection, T1213.002 Sharepoint |
| Defense Evasion | T1564.008 Email Hiding Rules |
| Persistence | T1098.005 Device Registration |
Get this coverage
The detections are on every Fluency instance. They need the Entra ID sign-in and audit logs — collected through Azure Event Hubs or Microsoft Graph — and the Microsoft 365 audit log (Office365 Audit API). Event Hubs can also bring in non-interactive sign-ins, the token refreshes that show more of a replayed session. With only the Microsoft 365 audit log, Fluency still catches the capture, the mailbox and file activity, and the inbox rules.
Not a customer yet? Start a free trial or book a demo.
Related
- Storm-2372: device-code phishing — another way to steal an MFA-approved session.
- Business email compromise — what attackers do with the mailbox once they are in.
- Entra ID Detection Update — the full release, with triage guidance for each alert.