Hackers Increasingly Abusing Microsoft Graph API for Stealthy Malware Communications

Symantec researchers and industry reports describe increasing abuse of the Microsoft Graph API and OneDrive as covert command-and-control channels by multiple nation-state-aligned groups since 2021–2022. The report highlights observed implants such as Graphon and a newly documented BirdyClient (aka OneDriveBirdyClient) using a DLL named vxdiff.dll to upload/download to OneDrive, and warns that attackers may leverage trusted cloud services and compromised third-party privileged access to execute commands on VMs.