🧰 Microsoft OneDrive

The items that name it 3

• China-aligned TA419 impersonates Anthropic employee, ex-White House official to phish AI policy experts
  article2026-10-02

  Impersonated via a fake OneDrive folder listing/loading screen and sign-in prompt used as the credential phishing lure

• Socket: 5 Malicious NuGet Packages Target Chinese .NET Developers
  writeup2026-05-07

  Its installation directory C:\ProgramData\Microsoft OneDrive\ is abused to stage stolen data as keys.dat.

• Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign
  article

  Abused as a C2 channel by Antino via Microsoft Graph for heartbeat and file transfer.