Microsoft Graph API Exploited for Stealthy Attacks

Attackers are abusing the Microsoft Graph API to camouflage C2 and data exfiltration inside legitimate Microsoft 365 traffic; the report highlights a Ukrainian incident where 'BirdyClient' (OneDriveBirdyClient) used OneDrive via Graph API as a hidden C2, references prior APT37 usage and tools like GraphStrike/Cobalt Strike, and urges monitoring API usage, detecting anomalous cloud transfers, and proactive threat intelligence.