A1 Storm-2755
Adversary-in-the-middle session theft
A reverse-proxy phishing page relays the real Microsoft sign-in. The victim completes MFA and the attacker keeps the session.
How the attack works
- 1Victims reach a fake Microsoft 365 sign-in through search ads and SEO poisoning.
- 2The proxy relays the password and MFA response in real time and keeps the session token that comes back.
- 3The token is replayed later from new networks, often by a script, to search for payroll and HR content.
- 4Inbox rules hide the replies. In one reported case the attacker changed bank details in a payroll system.
Source: Microsoft Threat Intelligence, Storm-2755 (April 2026)
Respond: Revoke sessions first, then reset the password, remove attacker MFA methods and inbox rules, and check payroll and banking changes.
The full investigation · 16 pages
Adversary-in-the-Middle in Practice
The 3:00 explainer
How Fluency follows it
CaptureAlerts
A sign-in that ends in an error after MFA succeeded — the mark a relaying proxy leaves behind.
ReplayAlerts
The captured session used again from a network it has never come from.
ActivityAlerts
Mail, SharePoint or OneDrive access under the captured session from that new network.
HideAlerts
Inbox rules with throwaway names that exist to bury replies.
PersistTimeline context
New or changed authentication methods, recorded on the timeline.
