Nation-state espionage operations are increasingly using native Microsoft services to host their command-and-control (C2) needs. A number of unrelated groups in recent years have all come to the same ...

TWINLOOT uses SharePoint, Teams, Azure and the victim’s own Edge browser to hide command-and-control traffic inside trusted Microsoft infrastructure.

Microsoft on Friday announced the general availability of the "activity logs" capability in Microsoft Graph, giving administrators more options to track user activity and, in theory, identify patterns ...

A Python-based malware framework is taking the concept of living off the land (LOTL) to a whole new level by operating its entire command-and-control (C2) from inside Microsoft Azure and 365 services, ...

Microsoft is introducing a new way for developers to get insight into how applications are accessing data through Microsoft Graph, an API that feeds data into Microsoft 365 applications and other ...

Graph Developer Proxy allows developers to test their Microsoft Graph applications locally by simulating Microsoft Graph API errors and mocking Microsoft Graph API responses. With Microsoft Graph ...

TWINLOOT uses SharePoint, Teams, Azure and the victim’s own Edge browser to hide command-and-control traffic inside trusted Microsoft infrastructure. Security researchers are warning of a newly ...