Who Is Targeting Canadian Organizations, and What Stops Them
A research brief for IT and security leaders on the threat actors naming Canada as a target, why multi-factor authentication alone no longer stops them, and what a 24/7 Canadian security operations centre changes.
Executive Summary
The targeting is not random. It has a name.
For years, the working assumption in security has been that most organizations are opportunistic targets, caught in a wide net rather than singled out. That assumption no longer holds for Canadian organizations. In April 2026, Microsoft Threat Intelligence published findings on a threat actor it designates Storm-2755, the first Microsoft-attributed group whose primary target is Canada specifically. It is not alone. The Canadian Centre for Cyber Security has tracked more than 100 adversary-in-the-middle phishing campaigns aimed at Canadian Microsoft 365 tenants, and 43% of Canadian organizations report being targeted in the past 12 months.
This paper is written for the people who have to answer for that exposure: IT and security leaders at mid-market and enterprise organizations. It covers who is targeting Canadian businesses right now, why the authentication method most teams trust has stopped being sufficient against that targeting, what a breach costs when it lands, and what a continuously monitored, Canadian-run security operation changes about the outcome.
Three findings organize the paper:
Canada is a named target, not a bystander. Storm-2755 and the broader AiTM campaign activity documented by the Cyber Centre name Canadian organizations specifically, across healthcare, government, financial services, education, and manufacturing.
The control most teams rely on has a documented gap. Standard multi-factor authentication does not stop session-token theft, the exact technique behind the current wave of attacks on Canadian Microsoft 365 tenants.
The cost has a number, and it is rising. The average Canadian data breach now costs CA$6.98 million, and organizations without continuous, AI-augmented monitoring are paying the larger share of that figure.
1. You Were Not a Random Target
In the past 12 months, 43% of Canadian organizations report being targeted by a cyberattack, and 42% experienced an actual breach of customer or employee data, a sharp rise from 29% in 2022 (Source: CIRA 2025 Cybersecurity Survey). That increase is not fully explained by more attacks happening everywhere. It reflects a specific shift: threat actors are now building campaigns around Canada as a region, not catching Canadian organizations incidentally in a global sweep.
The Canadian Centre for Cyber Security’s National Cyber Threat Assessment 2025-2026 names the People’s Republic of China as the most sophisticated and active state cyber threat to Canada today, conducting espionage against the private sector to support research and development theft. Russian-linked actors are assessed as very likely targeting Canadian government, military, private sector, and critical infrastructure networks, and Canadian organizations are also exposed to global supply chain compromises tied to Russian threat activity. Ransomware, the CCCS assesses, is almost certainly opportunistic rather than industry-specific, which is its own warning: no sector is exempt by virtue of what it does.
What changed in 2026 is more specific still. A financially motivated actor began running a campaign built entirely around Canadian employees, Canadian payroll systems, and Canadian Microsoft 365 tenants. That campaign is the subject of the next section.
43% of Canadian organizations were targeted by a cyberattack in the past 12 months (Source: CIRA 2025 Cybersecurity Survey)
42% experienced a breach of customer or employee data, up from 29% in 2022 (Source: CIRA 2025 Cybersecurity Survey)
100+ AiTM phishing campaigns tracked against Canadian Microsoft Entra tenants since 2023 (Source: Canadian Centre for Cyber Security)
2. The Case File: Storm-2755
In April 2026, Microsoft’s Detection and Response Team published findings on Storm-2755, also tracked as Payroll Pirate, a financially motivated threat actor whose campaign specifically names Canada, alongside the United States and Europe, as its primary target region. Confirmed targets span healthcare, education, manufacturing, financial services, and government organizations of all sizes (Source: Microsoft Threat Intelligence, April 2026; Arctic Wolf Labs).
The attack does not look like a break-in. It begins with search engine poisoning and malicious advertising, positioning an actor-controlled domain at the top of search results for ordinary queries like “Office 365,” or common misspellings. An employee searching for the Microsoft 365 login page lands instead on a convincing fake, built as an adversary-in-the-middle proxy that sits between the victim and the real Microsoft service. The employee enters their credentials and completes multi-factor authentication exactly as they always do, and it works. Login succeeds. Nothing looks wrong.
What the employee does not see is that the proxy captured the live session token during that legitimate-looking exchange. From that point, Storm-2755 holds an authenticated session and needs neither the password nor the MFA prompt again. The group then quietly searches the compromised mailbox for payroll and HR processes and redirects salary deposits to an attacker-controlled account. In the documented cases, the theft went unnoticed until an employee’s paycheck simply did not arrive (Source: Microsoft Threat Intelligence; Xcitium Threat Labs).
“Storm-2755 is not a theoretical threat. It is the first Microsoft-attributed threat actor whose primary target is Canada specifically.”
— Microsoft Threat Intelligence, April 2026
3. Why MFA Stopped Being Enough
Multi-factor authentication remains a genuinely important control, and removing it would make any organization more exposed, not less. What Storm-2755 and the wider AiTM campaign activity against Canadian tenants demonstrate is that standard MFA was built to stop a different problem than the one attackers are now running.
Standard MFA asks a simple question at the moment of login: is this the real user? An adversary-in-the-middle attack does not try to answer that question incorrectly. It lets the real user answer it correctly, because the real user is doing the logging in, through a proxy the user cannot see. The attacker is not guessing a password or defeating a one-time code. They are capturing the session that results after both were entered correctly, and token theft makes SMS codes, authenticator apps, and push notifications equally irrelevant, because the capture happens after MFA is satisfied, not before (Source: Canadian Cyber Security Journal, 2026).
The practical consequence for IT and security leaders is that “we have MFA enabled” is no longer a sufficient answer to the question of whether an organization is protected against the campaigns currently targeting Canada. The relevant question has shifted to whether anything is watching for the session behaviour that follows a successful, entirely legitimate-looking login.
6 stages in the documented AiTM redirect chain used to evade reputation-based email filters (Source: Canadian Cyber Security Journal, 2026)
0 warning shown to the user; login completes normally while the session token is captured live (Source: Microsoft Threat Intelligence, 2026)
69% of Canadian organizations now rank data staying in Canada as their top sourcing factor (Source: Cybersecurity Canada Report 2026)
4. What a Breach Costs in Canada Now
The average cost of a data breach for a Canadian organization has reached CA$6.98 million (Source: Cybersecurity Canada Report 2026). That figure sits inside a wider pattern documented by IBM’s global research: organizations that identify and contain a breach quickly pay substantially less than those that do not, and the gap is driven almost entirely by how fast the organization notices.
The Storm-2755 case illustrates why detection speed matters more than prevention alone can guarantee. Every control in the chain, the search result, the login page, the MFA prompt, can look correct to the person experiencing it. The only thing that breaks the illusion is behaviour after the fact: a session token used from an unfamiliar location, a mailbox rule created to search for payroll correspondence, a banking detail changed outside of normal process. Organizations that caught Storm-2755 activity did so through exactly this kind of monitoring, not through the login step itself.
IBM’s research adds a specific, current data point to this picture: organizations that run AI-augmented security operations see breach costs that run CA$3.34 million lower than organizations that do not (Source: IBM Cost of a Data Breach Report 2025, as cited in the Cybersecurity Canada Report 2026). The pattern holds across the data: the organizations paying less are the ones watching continuously, not the ones with the most controls on paper.
“Traditional MFA is no longer enough, and Canadians are being specifically targeted.”
— Cybersecurity Canada Report 2026
5. What Stops a Targeted Campaign
A campaign built around session theft and legitimate-looking logins cannot be stopped at the front door alone. It has to be caught in motion. Four practices, applied together, close the gap that standard MFA leaves open.
Phishing-resistant authentication where it matters most. FIDO2 hardware keys or passkeys on privileged and financial-system accounts remove the session a proxy can intercept, unlike codes and push approvals, which an AiTM attack can relay.
Continuous monitoring of session and sign-in behaviour. The giveaway in the Storm-2755 case was never the login. It was the sign-in anomaly and the mailbox activity afterward, which only a monitored environment catches in time to matter.
A verification step for anything touching payroll or banking details. Any change to deposit information or financial routing gets confirmed through a second, already-known channel, regardless of how legitimate the request looks inside the mailbox.
A team watching around the clock. Storm-2755’s activity does not pause for business hours, and detection without a team to act on it is a log entry, not a stopped attack.
6. Recommendations for IT and Security Leaders
These recommendations are directed at IT and security leaders at mid-market and enterprise organizations evaluating their exposure to the current wave of Canada-targeted campaigns.
1. Confirm your MFA method, not just that MFA exists. An MFA checkbox is not the same as phishing-resistant MFA. Confirm which accounts use methods that resist session relay, starting with finance, HR, and administrative access.
2. Add a human verification step to payroll and banking changes. This single step defeats the entire financial objective of the Storm-2755 campaign, regardless of whether the session itself was compromised.
3. Monitor sign-in and mailbox behaviour continuously. The anomaly that exposes this kind of attack happens after login, not during it. Monitoring has to extend to session and mailbox activity, not stop at the authentication event.
4. Assume Canada is a named target, not a statistical afterthought. Plan defenses against campaigns built specifically for Canadian tenants and Canadian business processes, not generic global threat models.
5. Know who is watching, and when. A control that no one is monitoring around the clock is a control waiting to be found by whoever looks first, and the data shows that is rarely the defending organization.
Quick Intelligence runs security and IT as one team, watched 24 hours a day by a Canadian security operations centre. The threats detailed in this paper are aimed at Canadian organizations specifically, and we believe the team watching for them should be here too.
Take the Resilience Assessment →
Book a Consultation →
Methodology Note
Microsoft Threat Intelligence, April 2026. Primary source for the Storm-2755 (Payroll Pirate) attack chain, targeting scope, and attribution as the first Microsoft-named threat actor whose primary target is Canada.
Canadian Centre for Cyber Security, National Cyber Threat Assessment 2025-2026. Primary source for state-actor assessments (PRC, Russia) and the count of AiTM phishing campaigns against Canadian Microsoft Entra tenants.
CIRA 2025 Cybersecurity Survey. Source for the 43% targeting rate and 42% breach rate among Canadian organizations in the past 12 months.
Cybersecurity Canada Report 2026. Source for the CA$6.98 million average Canadian breach cost, the AI-augmented monitoring cost differential, and the 69% data-residency sourcing finding.
IBM Cost of a Data Breach Report 2025. Source for the relationship between AI-augmented security operations and reduced breach costs, as cited in the Cybersecurity Canada Report 2026.
Arctic Wolf Labs; Canadian Cyber Security Journal, 2026. Additional technical detail on the Storm-2755 AiTM redirect chain and session-token mechanics.
Statistics Canada, Canadian Survey of Cyber Security and Cybercrime (2023 data). Supporting source for broader Canadian incident and impact figures referenced in sector reporting.
