Microsoft Graph API Emerges as a Top Attacker Tool to Plot Data Theft

Nation-state and espionage groups increasingly abuse Microsoft Graph and other Microsoft cloud services (notably OneDrive) to host command-and-control infrastructure; the report lists multiple malware families (e.g., BirdyClient, Bluelight, Backdoor.Graphican) and APTs (APT37, APT15, APT29, Harvester) observed using this technique and advises tightening tenant controls and blocking unsanctioned cloud account access.