⌁ CyberSecurityBoardThreat Intel · CVEs · Products
Malware

GraphSpy: Post-Exploitation Tool for Microsoft 365 and Entra

July 7, 2026

GraphSpy is a tool used for post-exploitation of Microsoft 365 and Entra environments, often integrated into PhaaS platforms like DEBULL. It enables attackers to perform reconnaissance, data exfiltration, and persistence via Microsoft Graph API.