On June 22, 2026, the cybersecurity agencies of the Five Eyes nations issued a joint statement with a warning business owners shouldn’t treat as abstract: frontier AI models could transform cyberattack capabilities within months, not years.
The statement, titled “The AI Shift in Cyber Risk: Why Leaders Must Act Now,” was backed by agencies in Canada, the United States, the United Kingdom, Australia, and New Zealand. Rajiv Gupta, head of the Canadian Centre for Cyber Security, joined leaders from CISA, the NSA, and allied agencies in warning that AI is lowering the barrier for attackers, increasing the speed and complexity of attacks, and shrinking the time between vulnerability discovery and exploitation.
That can sound like a warning for governments and critical infrastructure. It does apply there, but the nearer danger for Canadian small businesses is already visible in a simpler place: payroll.
Microsoft says a financially motivated group it tracks as Storm-2755 has been targeting Canadian workers, stealing Microsoft 365 sessions, entering payroll systems, and redirecting salaries to attacker-controlled bank accounts. This isn’t a future AI risk. It’s the kind of identity-based fraud that AI makes faster, cleaner, and harder for employees to catch.
AI didn’t invent phishing. It removed the friction.
The phishing email many people still picture is easy to spot: broken English, generic greeting, strange domain, obvious urgency, and a link that looks wrong if you slow down for two seconds. That version still exists, but it’s no longer the main problem.
AI lets attackers write clean, personalized messages at scale. A scam email can now reference colleagues, vendors, roles, deadlines, or document workflows that actually exist. Attackers can scrape company websites, LinkedIn profiles, job posts, press releases, and social media content, then turn that public information into messages that sound like they belong inside the business.
The Canadian Centre for Cyber Security’s National Cyber Threat Assessment for 2025-2026 already warned that cybercriminals are using AI to make phishing and fraud more persuasive. The Five Eyes statement takes that warning further: as models improve, attackers will be able to automate more of the work that used to require skill, patience, and technical infrastructure.
That changes the defensive problem. Employees aren’t only being asked to spot bad grammar anymore. They’re being asked to detect a convincing message that may contain accurate context, the right tone, and a login page that looks exactly like the service they use every day. The old “something feels off” defense doesn’t work as well when nothing obvious feels off.
Storm-2755 shows how the attack actually works
Microsoft’s April 2026 research on Storm-2755 gives the Five Eyes warning a Canadian face. The company calls the campaign “Payroll Pirates” because the goal is straightforward: get into an employee’s account, reach payroll, and move the next paycheque.
The targeting is unusually specific. Microsoft says Storm-2755 uses geographic filtering to focus on Canadian users rather than a single industry. That means a law firm, manufacturer, nonprofit, retailer, or local service business could all fall into the same target pool if the employee is in Canada.
The attack often starts with search. Storm-2755 uses SEO poisoning and malvertising to push attacker-controlled pages in front of people searching for Microsoft services. Microsoft specifically pointed to terms like “Office 365” and misspellings such as “Office 265.”
When a worker lands on the fake page, the site doesn’t only collect a password. It uses an adversary-in-the-middle technique to capture the authenticated session after the user signs in. In normal terms, the employee may enter the correct password and approve the MFA prompt, but the attacker steals the active session token that proves the login already happened. That token lets the attacker act as the user without needing another password or another MFA code.
From there, the payroll theft is quiet and practical. Microsoft says the attacker can enter Workday, change direct deposit details, and then create inbox rules that hide confirmation emails containing terms such as “direct deposit” or “bank.” The victim doesn’t see the warning email because the attacker has already moved it out of sight.
That’s what makes this so dangerous for small businesses. The attack doesn’t need to break payroll from the outside. It uses the employee’s identity from the inside.
Deepfakes make verification harder too
Phishing is only one piece of the AI fraud problem. Voice and video are now part of it.
In 2024, the global engineering firm Arup lost about $25 million after an employee in Hong Kong joined a video call with what appeared to be senior executives. The people on the call were deepfakes, and the employee was persuaded to authorize transfers before the fraud was discovered.
That case is extreme, but the underlying tactic is moving downmarket. Attackers don’t need a Hollywood-level fake to create pressure. A short cloned voicemail, a convincing email, and a follow-up chat message can be enough to make a payment request feel legitimate.
The raw material is often public. Conference clips, podcast appearances, webinars, sales videos, social posts, and company pages all become part of an executive’s digital footprint. The more public audio and video a business leader has online, the more material an attacker may have to imitate their voice or style.
This doesn’t mean leaders should disappear from the internet. It means teams need verification habits that don’t depend on recognizing a voice, a face, or a familiar writing style.
The Canadian cost is already high
Cyber fraud isn’t a theoretical line item for Canadian businesses. Cybersecurity Canada’s 2026 report says the Canadian Anti-Fraud Centre recorded CA$704 million in reported fraud losses in 2025, the highest annual total on record. The same report notes that only about 5% to 10% of fraud victims report incidents, which means the actual losses are likely far higher than the official number.
The report also cites IBM’s Canadian breach-cost data, putting the average Canadian breach at CA$6.98 million. That figure isn’t a neat prediction for every small business. A local company probably won’t face the same breach cost as a national enterprise. But it shows the direction of travel: investigation, recovery, legal work, downtime, customer notifications, lost trust, and insurance issues add up quickly.
Identity is the weak point. Cybersecurity Canada’s report says identity-based attacks drove 67% of investigated cyber incidents in Canada in 2025. That includes phishing, credential theft, and account takeover, which are exactly the areas AI makes easier to scale.
The same report points to a painful Canadian example: NioCorp Developments lost $500,000 after attackers compromised an email account and redirected a legitimate vendor payment to a fraudulent account. One account. One payment instruction. Half a million dollars.
Standard MFA isn’t enough for this attack
Many businesses hear “phishing” and assume the answer is MFA. That’s partly right, but it isn’t enough anymore.
Standard MFA methods like SMS codes and authenticator-app approvals can still be useful. They block many basic account-takeover attempts. But Storm-2755 shows the weakness: if an attacker tricks someone into logging in through an adversary-in-the-middle page, the attacker may capture the session after authentication has already happened.
In that case, the employee did what the system asked. They entered the right password. They approved the prompt. The attacker still got in.
That’s why Microsoft and the Cyber Centre both point businesses toward phishing-resistant MFA. FIDO2 security keys and properly deployed passkeys bind authentication to the legitimate domain. If the employee is on a fake login page, authentication should fail because the credential won’t validate against the wrong site. This is one of the most important upgrades Canadian businesses can make right now, especially for email, payroll, banking, admin accounts, cloud storage, and any system that can move money or expose customer data.
What businesses should change now
The answer isn’t panic. It’s tightening the places where AI-assisted attackers are most likely to win.
Move critical accounts to phishing-resistant MFA
Start with the accounts that can do the most damage: Microsoft 365 or Google Workspace admin accounts, payroll, banking, accounting software, password managers, domain registrars, cloud hosting, and executive email accounts. If hardware keys or passkeys feel like too much to roll out everywhere at once, don’t let that slow you down. Protect the highest-risk users first, then expand.
The goal is to stop treating all accounts as equal when some can move money, reset access, or expose the whole business.
Require out-of-band verification for money movement
Any request to change banking details, update payroll, wire money, or pay a new vendor should be verified through a separate channel. Use a phone number already on file, a known internal directory, or an in-person confirmation.
Don’t verify using the phone number or link supplied in the message making the request. If the original message is fake, the “confirmation” path may be fake too.
This rule should apply even when the request appears to come from the CEO, CFO, owner, or a trusted vendor. Especially then, because authority and urgency are exactly what make these requests work.
Check email rules and payroll changes
Storm-2755 hides evidence by creating inbox rules. That means businesses should periodically review email forwarding rules, hidden rules, delegated access, and unusual mailbox behavior, especially for finance, HR, executives, and payroll users.
Payroll teams should also review recent direct deposit changes, require stronger approval workflows, and confirm whether payroll platforms can send alerts to more than one trusted contact. If one compromised mailbox can hide the whole change trail, the process is too fragile.
Train people, but don’t make people the whole defense
Training still matters. Employees should know that AI can make fake messages sound normal, that MFA prompts can be abused, and that voice or video alone doesn’t prove identity.
But training can’t be the only wall. People get tired. People rush. People trust familiar names. The stronger move is to combine training with systems that make dangerous actions harder to complete without a second check.
That means phishing-resistant MFA, payment verification rules, mailbox monitoring, payroll controls, and clear reporting paths. Good cybersecurity protections don’t depend on every employee catching every fake perfectly.
Write the incident plan before the incident
If someone clicks a malicious link, approves a fraudulent payroll change, or notices a suspicious inbox rule, the team shouldn’t have to invent the response from scratch. Write down who gets notified, which accounts get locked, how sessions are revoked, who contacts the bank or payroll provider, how customers are notified if needed, and who reports to law enforcement or the Canadian Centre for Cyber Security.
The plan doesn’t need to be beautiful. It needs to exist before the day gets ugly.
The threat has already reached payroll
The Five Eyes statement is about what frontier AI models may do to cyber risk in the coming months. Storm-2755 shows what Canadian businesses are already facing now.
The problem isn’t only that attackers have better tools. It’s that many businesses still have old assumptions.
They assume phishing looks sloppy. They assume MFA means the account is safe. They assume a familiar voice is proof. They assume payroll changes are too ordinary to be part of a cyberattack. They assume cybersecurity is mostly an IT issue, not a money issue. AI is punishing those assumptions.
For Canadian small businesses, the practical move is to tighten identity controls first. Protect the accounts that matter. Verify financial changes outside the original channel. Watch for hidden mailbox rules. Treat voice and video requests as signals, not proof. Build a response plan while things are calm.
The warning from Canada’s intelligence partners is about months, not years. The payroll theft is already here.
Frequently asked questions
What is AI-powered phishing?
AI-powered phishing uses artificial intelligence to make scam messages more convincing, personalized, and scalable. Instead of relying on obvious spelling errors or generic greetings, attackers can use public information about a company, employee, vendor, or project to make a message feel normal.
Can MFA protect my business from attacks like Storm-2755?
MFA helps, but not all MFA methods protect against adversary-in-the-middle attacks. Standard SMS codes and authenticator prompts can still be bypassed if an attacker steals the authenticated session. Phishing-resistant MFA, such as FIDO2 security keys or properly deployed passkeys, is stronger because it binds authentication to the legitimate website domain.
Why is Storm-2755 targeting Canadians?
Microsoft’s research says Storm-2755 uses geographic filtering to target Canadian users, but the public reporting doesn’t confirm why Canada was chosen. The group appears financially motivated and focuses on stealing access that can be used to change payroll and direct deposit information.
Which accounts should small businesses protect first?
Start with accounts that can move money, reset access, expose customer data, or control business infrastructure. That usually includes email admins, payroll, banking, accounting software, password managers, domain registrars, cloud hosting, and executive inboxes.
What should I do if I think my business has been targeted?
Act quickly. Reset the affected password, revoke active sessions, check for unauthorized inbox and forwarding rules, review payroll or banking changes, and notify your IT provider or security lead. If money or sensitive data may be involved, contact your bank, payroll provider, insurer, local law enforcement, and the Canadian Centre for Cyber Security.
I can suggest related Tech Help Canada articles based on the topic you’re reading now.
We empower people to succeed through practical business information and essential services. If you’re looking for help with SEO, copywriting, or getting your online presence set up properly, you’re in the right place. If this piece helped, feel free to share it with someone who’d get value from it. Do you need help with something? Contact Us
Want a heads-up once a week whenever a new article drops?
