⌁ CyberSecurityBoardThreat Intel · CVEs · Products
Cyber Products

Microsoft Graph API: Used for C2 Tasking

June 25, 2026

TWINLOOT authenticates to an attacker's Azure tenant and uses the Graph API to interact with SharePoint drives for command and control.

Discovered from: TWINLOOT Malware Abuses SharePoint and Teams to Steal Credentials and Pivot Networks