Paycheque Pirates and 24-Hour Ransomware: The Cyber Threats Targeting Ontario Right Now

A threat actor Microsoft calls Storm-2755 has been quietly raiding the paycheques of Canadian workers. The method is unsettlingly simple: the group buys ad space on Google and Bing — or manipulates search results — so that when an employee types “Office 365 login” or even “Office 265” (a common typo), they land on a convincing fake Microsoft sign-in page. Once the employee enters their password, Storm-2755 captures their session token, allowing the attackers to log in as that person even if multi-factor authentication is enabled. From inside the account, they hunt for HR portals like Workday, locate the direct deposit form, and quietly reroute the next paycheque to a bank account they control. They then create hidden inbox rules so any emails about the change vanish before the victim sees them. Microsoft published its investigation on April 9, 2026, calling it a geographically targeted campaign aimed specifically at Canadian users — not a random spray of attacks, but a deliberate focus on this country.

Microsoft’s threat intelligence team has published detailed research on Storm-1175, a China-linked cybercriminal group running Medusa ransomware with alarming speed. Their signature move: weaponize software vulnerabilities before most businesses have even heard about the patch. In some confirmed cases, they went from exploiting a newly disclosed bug to fully encrypting a victim’s network in under 24 hours. Their current toolkit targets software many Ontario SMBs rely on — Fortra GoAnywhere file transfer software, SmarterMail email servers, ConnectWise ScreenConnect remote management tools, Microsoft Exchange, and Ivanti products. The group scans for internet-facing login portals, breaks in, moves laterally across the network, steals data using tools like Rclone, then deploys ransomware. Confirmed victims include a U.S. medical imaging company whose breach exposed data on 1.27 million patients, and a university hospital that lost nine days of patient care operations. Healthcare, professional services, education, and finance are the hardest-hit sectors.

ChipSoft, a Dutch company that provides electronic patient record software to roughly 80 percent of hospitals in the Netherlands, was hit by a ransomware attack on April 7, 2026. The attack forced the company to take its patient portal, mobile app, and hospital integration platform offline. At least eleven healthcare facilities had to shut down their ChipSoft systems as a precaution. The company has confirmed it cannot rule out that patient data — including names, addresses, national identification numbers, diagnoses, treatment histories, and insurance details — was accessed or stolen. As of April 12, no ransomware group has publicly claimed the attack, which security researchers say is unusual and may indicate that negotiations are underway behind the scenes. This incident echoes the 2024 Change Healthcare attack in the United States, where a single vendor’s compromise cascaded through hundreds of hospitals and clinics. For any Canadian business that depends on a single software platform — whether it is an accounting system, practice management software, or an ERP — the lesson is stark: your vendor’s security is your security.

Microsoft’s Defender Research Team has published details of a sophisticated phishing campaign that uses artificial intelligence end-to-end to compromise Microsoft 365 accounts — and it does not care whether employees have multi-factor authentication turned on. The attack exploits a legitimate Microsoft sign-in method called “device code flow,” normally used for smart TVs and printers that cannot display a browser login. Attackers trick employees into entering a short authentication code on a real Microsoft webpage — making the login look completely legitimate — and then harvest the resulting session token, bypassing MFA entirely. What makes this campaign remarkable is its use of AI to craft highly personalized phishing emails matched to the victim’s job role: invoice requests for accountants, RFPs for procurement managers, manufacturing workflow notices for operations staff. Automation platforms spin up thousands of unique, short-lived web nodes so traditional email filters never see the same link twice. The campaign has already compromised over 340 organizations across five countries.