The Voicemail That Slips Past MFA: Inside the Payroll Pirates Campaign

An email lands with a familiar shape. Microsoft branding, a caller ID, a button that says open your voicemail. The employee clicks. A login page appears, looking exactly like the one they use every day. They type a password, approve a multi-factor prompt, and move on with their morning. Nothing about that sequence feels wrong, and that’s the entire design behind it.

Researchers at Arctic Wolf have named this campaign Payroll Pirates. They describe it as sharing tactics with Storm-2755, the financially motivated cluster Microsoft's Detection and Response Team documented back in April, when the same voicemail lure targeted employees in Canada. The mechanism in both waves routes a victim through a chain of legitimate services, Google, Google Meet, Google Ads, and Amazon S3 among them, before landing on a convincing fake Microsoft sign-in page. That chain matters. Reputation-based filtering trusts Google and Amazon domains, so the early steps of the journey slip past that specific layer of defense.

The fake page sits in the middle of the genuine login. It relays the actual Microsoft authentication flow as it happens, which is why the employee’s password and MFA code both work exactly as expected. The attacker skips the work of guessing a password or defeating a code entirely, capturing the session cookie and access token issued the moment authentication succeeds, then walking through the front door with them.

Why the Lure Works So Well

Stuart Madnick, who directs cybersecurity research at MIT Sloan, has spent years studying why smart, careful people click on things they shouldn’t. He once described a case where an email appeared to come from a university department chair, asking staff to grab a hundred-dollar gift card for a nephew’s birthday. Half a dozen people fell for it. His conclusion applies directly here: “Basically, you’ve got to be alert. You’ve got to be cautious.”

A voicemail notification is about as low-stakes and ordinary as a workplace email gets. That ordinariness is the whole point. Attackers aren’t inventing elaborate fiction. They’re copying something routine closely enough that routine behavior takes over.

Why Payroll and Finance Inboxes Specifically

Once inside an account, the attackers wait before acting. Microsoft’s own security investigators found what happens next: the attacker searches the company's employee directory, using a built-in Microsoft tool, for people whose job titles involve payroll, HR, finance, or company administration. Only after finding those employees do they make their move. That search step explains the economics here. A compromised inbox belonging to someone in finance turns into fraud far more directly than almost any other target, so the campaign is built to find those inboxes specifically instead of acting on the first account it happens to land in.

The organizations affected span healthcare, education, manufacturing, government, and professional services, across the United States, Canada, and Europe. That breadth is useful information for any finance or payroll team wondering whether this applies to them.

What This Looks Like in Adaptive's Detection Data

Native tools in Microsoft 365 and Google Workspace catch roughly 80 percent of malicious email volume, but that volume is mostly noise: known malware, blocklisted senders, and mass-blast spam that reuses infrastructure already flagged as bad. None of it takes much effort to build, since it relies on volume instead of originality, which is exactly why native filters catch it so reliably. The remaining 20 percent is where the damage that matters happens, precisely because it leaves nothing for a signature or reputation engine to catch. Payroll Pirates sits squarely in that slice. 

Adaptive classifies attacks hosted on legitimate cloud infrastructure, the Google and Amazon chain this campaign rides on, as cloud platform abuse, since the sender and link genuinely resolve to a trusted service and give reputation filters nothing to flag. The economics track: Adaptive’s data puts the average cost of a credential phishing incident at $130,000, with financial fraud close behind at $121,000, right in line with a campaign built specifically to reach payroll and finance.

Where Standard MFA Runs Into a Wall

Bruce Schneier, a lecturer in public policy at Harvard Kennedy School and a fellow at Harvard’s Berkman Klein Center, has written about exactly this category of attack. Comparing MFA methods, he noted that “FIDO2 multi-factor authentication systems are not susceptible to these attacks, because they are tied to a physical computer.” One-time codes and push approvals, by contrast, get relayed straight through a proxy sitting between the employee and the genuine login page.

That gap is exactly why this campaign works. Most companies still rely on one-time codes and push approvals instead of security keys, and those are precisely the methods this proxy is built to get around.

What Closes the Gap

• The single most effective fix is switching to phishing-resistant multi-factor authentication, meaning a physical security key or a passkey instead of a text code or an app approval. This matters most for anyone who can touch payroll, banking, or finance systems. A security key or passkey never leaves the device it’s tied to, so there’s nothing left for a fake login page to capture.
• Microsoft 365 has a built-in feature made for exactly this problem, called Conditional Access token protection. It locks a login session to the one device that created it, so if an attacker steals that session through a fake page, it simply won’t work on a different computer. Microsoft also offers Continuous Access Evaluation, which can cut off a session within minutes if something looks wrong, such as a sign-in from an unexpected location. Turning both on together closes the exact gap this campaign is built to exploit.
• IT teams can set up a simple mail rule that flags any voicemail-style email coming from outside the company before it reaches an inbox. A genuine company voicemail alert almost never arrives as an outside email with a generic “click here” button, so this pattern is easy to catch without blocking normal messages.
• Monitoring sign-ins and active sessions across Microsoft 365 catches things a password check alone never will. A sign-in from a new device or location right after someone opens a voicemail-style email is a clear warning sign, and it’s worth building an alert around that exact pattern.
• Payroll and finance teams benefit from one habit above all others: verifying any request involving money movement or account changes through a second channel, regardless of how legitimate the original message looks. That single habit closes the loop the technical controls above can’t fully close on their own.
• Training earns its place here too, at a different layer than the technical fixes above. Most awareness programs cover generic phishing well. Fewer have shown employees a voicemail-themed lure built exactly like this one. A short, targeted simulation gives payroll and finance staff a safe first encounter with the pretext, catching it before the click happens. That sits alongside token protection and phishing-resistant MFA, covering the moment before someone clicks rather than the moment after.

Building This Together

These fixes strengthen what's already in place rather than replacing it. IT teams already manage MFA policy, mail filtering, and sign-in monitoring. Payroll and finance staff already know their own workflows better than any outside tool ever will. Security awareness programs already exist to close exactly this kind of gap. Payroll Pirates succeeds by finding the seams between these groups, so closing it works best as a shared effort rather than one team’s solo project.

At Adaptive Security, this is precisely the kind of campaign our voice and email phishing simulations are built to mirror, giving finance and payroll teams practice recognizing this exact pretext before the click. That’s the human layer. Token protection and phishing-resistant MFA are the technical layer underneath it, catching anyone who clicks anyway. Layered together, that combination is how a well-engineered attack ends without a single paycheck moving.