Microsoft Graph API misused by new GoGra Linux malware for hidden communication

A new Linux variant of the GoGra backdoor, attributed to the Harvester APT, uses hardcoded Azure AD credentials to obtain OAuth2 tokens and polls a specific Outlook mailbox via Microsoft Graph API (folder named "Zomato Pizza") to receive AES-CBC encrypted commands and return encrypted results, deleting messages to evade detection; researchers report cross-platform code similarity with the Windows variant and early targeting evidence from South Asia.