Signal
Canadian Microsoft employees targeted in payroll hijacking campaign
Evidence first: scan the strongest sources, then decide whether to go deeper.
Published 2026-04-10 11:30 UTCUpdated 2026-04-10 11:56 UTC
rss
cveexploitsbreachesmalwarethreat_actorsadvisories
Source links open
Source links and full evidence are open here. Archive history, compare-over-time, alerts, exports, API, integrations, and workflow are paid.
No card needed for the free brief.
Evidence trail (top sources)
top sources (2 domains)domains are deduped. counts indicate coverage, not truth.2 top sources shown
limited source diversity in top sources
Overview
A financially motivated threat actor known as Storm-2755 is conducting a sophisticated campaign targeting Canadian Microsoft employees to steal their salary payments.
Entities
Microsoft
Score total
1
Momentum 24h
2
Posts
2
Origins
2
Source types
1
Duplicate ratio
0%
Why now
- Recent discovery of active campaign targeting Canadian Microsoft employees.
- Attackers exploit common search queries and misspellings to increase victim reach.
- Timely warning for organizations using Office 365 to review security controls and user awareness.
Why it matters
- Highlights risks of SEO poisoning and phishing in payroll fraud schemes.
- Demonstrates threat actors’ use of sophisticated multi-vector attacks targeting employee payroll.
- Alerts organizations to protect payroll systems and educate employees on phishing threats.
LLM analysis
Topic mix: lowPromo risk: lowSource quality: high
Recurring claims
- Threat actor Storm-2755 hijacks Canadian employees' payroll accounts to steal salary payments
- Attackers use SEO poisoning of Office 365 search results and phishing to redirect paychecks
How sources frame it
- BleepingComputer: neutral
- Help Net Security: neutral
All evidence
All evidence
Microsoft: Canadian employees targeted in payroll pirate attacks
bleepingcomputer_all · bleepingcomputer.com · 2026-04-10 11:56 UTC
Poisoned “Office 365” search results lead to stolen paychecks
Help Net Security · helpnetsecurity.com · 2026-04-10 11:30 UTC
Show filters & breakdown
Posts loaded: 0Publishers: 2Origin domains: 2Duplicates: -
Showing 2 / 0
Top publishers (this list)
- bleepingcomputer_all (1)
- Help Net Security (1)
Top origin domains (this list)
- bleepingcomputer.com (1)
- helpnetsecurity.com (1)