Graph API – CyberSecurityBoard

Malware

TWINLOOT Malware Abuses SharePoint and Teams to Steal Credentials and Pivot Networks

Cybersecurity researchers have uncovered a new Python-based implant framework called TWINLOOT that abuses trusted Microsoft services for command-and-control (C2) operations. The malware,…

Backdoor.Turn Broadcom C2 infrastructure Carbon Black

August 18, 2026

Malware

HollowGraph Malware Uses Microsoft 365 Calendar Events Dated 2050 for C2 and Data Exfiltration

Group-IB has discovered a new espionage implant named HollowGraph that hijacks Microsoft 365 calendars for command-and-control (C2) and data exfiltration. The malware,…

C2 Cavern Cavern Manticore Check Point

July 20, 2026

Malware

GraphSpy: Post-Exploitation Tool for Microsoft 365 and Entra

GraphSpy is a tool used for post-exploitation of Microsoft 365 and Entra environments, often integrated into PhaaS platforms like DEBULL. It enables…

Data Exfiltration Entra Graph API GraphSpy

July 7, 2026

Cyber Products

Microsoft Graph API: Used for C2 Tasking

TWINLOOT authenticates to an attacker's Azure tenant and uses the Graph API to interact with SharePoint drives for command and control.

C2 Graph API Microsoft Graph API SharePoint

June 25, 2026