🧰 Microsoft Graph API

The items that name it 5

• Microsoft Threat Intelligence (@MsftSecIntel) on X
  advisory2026-10-17It is written here as Microsoft Graph API (used for reconnaissance).

  used for reconnaissance

• OAuth Token Theft Through Microsoft's Front Door | Huntress
  writeup2026-09-23

  Accessed via stolen tokens with broad delegated scopes (Mail, Files, Teams, Directory, Calendar, AuditLog.Create, etc.)

• Passkey-themed social engineering leads to identity and cloud compromise
  writeup2026-09-09

  Abused for tenant reconnaissance (users, groups, roles, applications, sites, messages) and automated data collection.

• Inside Kali365, a Device Code Phishing Ecosystem | Huntress
  writeup2026-06-11

  Used by OctoLink Sender to send mail as victims and check tokens via /me call

• 6 Months of Researching OAuth Application Attacks | Huntress
  writeup2025-02-10

  API called by malicious/legitimate OAuth apps to access tenant resources (e.g. emails) via delegated permissions