File Acquisition May Be Recorded as “FileAccessed” in Microsoft 365 (“M365”)

This report warns that multiple threat actor groups are leveraging phishing/vishing and identity/token abuse to automate large-scale file exfiltration from Microsoft 365 (SharePoint, OneDrive, Entra ID and connected apps) via Microsoft Graph and scripted tooling; importantly, forensic telemetry may show these acquisitions as “FileAccessed” rather than “FileDownloaded,” so investigators should evaluate access method, user agent, volume, velocity, and surrounding activity before concluding files were not acquired.