A single phishing email, a malicious OAuth app, and three days of silent data theft—that’s all it took for attackers to exfiltrate 8.7 million files from 72 SharePoint sites, according to a new analysis from LevelBlue. The report, published July 23, details how modern cybercriminals are ditching malware and zero-day exploits in favor of logging in with trusted identities and abusing Microsoft 365 services that organizations already approve.
The investigation, drawn from over 1,500 incident response cases, reveals a pattern that upends traditional security thinking: attackers are weaponizing Microsoft Graph API, search engines, and even Microsoft Copilot to blend into normal business activity. In every case, authentication checks, endpoint detection, and multi-factor authentication worked as designed—yet they failed to stop the breach because the attacks exploited trusted tools, not vulnerable code.
The Mechanics of a Cloud-First Intrusion
The most damaging incident started with a weaponized email promising an end-of-year bonus. Once the attacker tricked a user into handing over an authentication token, they didn’t plant ransomware or move laterally across the network. Instead, they registered a malicious OAuth application and used the Bun JavaScript runtime to silently query Microsoft Graph API. The goal: enumerate every user, SharePoint site, and mailbox within reach.
Over approximately 72 hours, the attacker pulled down 8.7 million files. No data loss prevention alarm fired. No endpoint detection and response tool flagged anything unusual. “It looked like Outlook,” said Devon Ackerman, the LevelBlue analyst who presented the findings. Graph API requests from a legitimate authenticated application simply didn’t raise red flags.
Why was Microsoft Graph so attractive? It’s the connective tissue for countless Microsoft 365 services—Outlook, Teams, SharePoint, and many third-party integrations all rely on it. In a busy tenant, a spike in API calls can easily vanish among the noise of legitimate automation, mobile sync, and admin tasks.
When Search Results and AI Become Intruders
Two other incidents in the report underscore that the perimeter has shifted well beyond the corporate firewall. In one, an employee searching for a legal template clicked a sponsored search result—a poisoned ad that redirected to a forum hosting a malicious document. That file installed a legitimately signed remote access tool (RAT), giving attackers interactive control within 16 hours. They mapped network drives, searched Outlook, and grabbed sensitive files without ever deploying custom malware or moving to another machine.
In the third case, a social engineer posed as a call-center worker and installed another legitimate RAT. But this time the attacker did something novel: they opened the victim’s own Microsoft Copilot and asked it to find spreadsheets containing passwords. Copilot, which respects existing user permissions, simply retrieved files the user already had access to—accelerating what would normally be a slow, manual hunt for credentials.
“AI didn’t break security,” Ackerman noted. “It accelerated discovery of data the threat actor already had access to.”
The Real Threat: Trust as an Attack Surface
These intrusions dismantle a long-held security assumption: if the tool is legitimate, the activity is benign. OAuth consent prompts, signed binaries, official APIs, and enterprise AI are all designed to increase productivity—but each can be co-opted without triggering a single antivirus alert.
What does this mean for you, whether you’re an everyday Windows user, a power user managing a small business tenant, or an IT administrator?
For Everyday Users and Small Business Owners
You might think this only happens to large organizations, but phishing and search engine manipulation don’t discriminate. The lesson is broader: be suspicious of OAuth permission dialogs asking for access to your files, mail, or contacts—even if the app looks polished. Sponsored search results can be weaponized, so verify the domain before downloading anything. And if you receive a remote support call you didn’t initiate, hang up.
For Power Users and Microsoft 365 Admins
The report highlights three immediate priorities:
- OAuth governance is no longer optional. Restrict user consent for high-risk permissions, require admin approval for sensitive scopes, and regularly audit existing enterprise applications. An OAuth token is a persistent access key that survives password changes.
- Monitor Graph API activity like you monitor sign-ins. Understand baseline API call volumes per user and application. A sudden surge in file enumeration across multiple SharePoint sites should be a critical alert.
- Remote access tools need explicit allowlisting. Just because a RAT is signed and commercially available doesn’t mean it should execute in your environment. Use AppLocker or Windows Defender Application Control to block unauthorized tools, and require help-desk tickets for any remote support session.
For Security Teams and IT Decision Makers
The evolution from malware to API abuse demands a behavioral detection model. Start correlating signals across identity, endpoint, browser, and cloud telemetry:
- A user receives a phishing email and then grants consent to a new OAuth app.
- A freshly registered application begins enumerating SharePoint sites at 2:00 a.m.
- A single account downloads hundreds of files from departments they never access.
- Copilot activity surges against sensitive repositories that were previously untouched.
Each event alone may look normal; together, they tell a different story. As Ackerman put it, “No lateral movement does not mean low impact.” A single compromised identity with broad file access can be enough for extortion.
How We Got Here: The Slow Collapse of the Perimeter
The cloud didn’t just move data off-premises—it rewired how trust works. OAuth 2.0 delegated machine-to-machine and user-to-app authorization became the standard because it’s seamless. Search engines became the front door to most work tasks. Remote tools filled the gap during pandemic-era remote work. And AI assistants made sense of sprawling data estates.
But security practices lagged. Many organizations still treat the endpoint as the main battlefield, relying on malware signatures and vulnerability patches while ignoring cloud API traffic. Microsoft Graph activity logs often get retained for just 30 days—too short for a forensic investigation. And IT departments rarely treat OAuth consent as a privileged-access event, even though an accepted permission can grant more power than a domain admin in the on-premises world.
Microsoft has added controls over the years—conditional access, app consent policies, risky sign-in alerts—but enforcement is optional and often left at default. The result: a growing gap between the sophistication of cloud-native threats and the telemetry available to detect them.
What to Do Now: A Defensive Playbook
The LevelBlue analysis doesn’t call for a wholesale replacement of your security stack. Instead, it demands better use of existing capabilities and a shift in how you view trust.
-
Harden Identity and Sessions
- Enforce phishing-resistant MFA where possible (e.g., FIDO2 keys).
- Use Azure AD Conditional Access to block impossible travel and risky sign-ins automatically.
- Enable token protection and session hijacking detection. -
Govern OAuth Aggressively
- In the Azure portal, under Enterprise applications > Consent and permissions, restrict user consent for high-risk permissions (e.g.,Mail.Read,Files.Read.All,Sites.Read.All).
- Create an app inventory, assign an owner to each, and remove any dormant or unverified apps.
- Alert on new application registrations and credential changes via the Microsoft Graph audit log. -
Turn On Cloud and API Telemetry
- Forward Microsoft 365 audit logs (including Graph activity) to your SIEM or Microsoft Sentinel.
- Set up analytics rules for abnormal volume: SharePoint page visits, search queries, file downloads.
- Correlate sign-in events with subsequent OAuth consent or API activity. -
Reduce Data Exposure Before Expanding AI
- Perform a permissions review: identify SharePoint sites set to “Everyone except external users” and remove overly broad sharing links.
- Scan for sensitive content (passwords, PII) in spreadsheets and documents—Copilot will find this faster than any human attacker, so clean it up now.
- Implement just-in-time access for file shares and collaboration spaces. -
Control Remote Access Software
- Use Windows Defender Application Control or AppLocker to block unauthorized remote desktop tools.
- Monitor for new installations of RATs via your endpoint management solution, and require centralized licensing so only approved tools can be used.
- Correlate remote sessions with ticketing systems—if a session starts without a help-desk ticket, investigate immediately. -
Retrain Your Users
- Move beyond phishing: explain how malicious search ads work, how to scrutinize OAuth consent screens, and why they should never install remote tools at a caller’s request.
- Simulate a poisoned search result or a fake tech support call in your next security awareness drill.
Outlook: What to Watch Next
These attack patterns are not a one-off. As organizations race to deploy more AI assistants and integrate more SaaS services, the attack surface of “trusted APIs” will only expand. Microsoft is expected to continue tightening OAuth controls—for example, by deprecating legacy authentication and expanding consent policy protections—but the onus remains on tenants to turn these features on.
Security vendors are equally likely to invest in behavioral analytics that can detect low-and-slow Graph abuse and AI-assisted discovery. However, the fundamental conclusion from LevelBlue’s research is this: in a world where the attacker can log in instead of breaking in, trust must be continuously verified, never implicitly granted.