You've Got (Graph) Mail: How Attackers Are Silently Exfiltrating Microsoft 365 Data via Graph API Webhooks
In November 2026, NetSPI disclosed a post-exploitation data exfiltration technique leveraging Microsoft Graph API Change Notifications (Rich Notifications) to silently siphon Outlook emails and Microsoft Teams messages from compromised Microsoft 365 tenants. By registering attacker-controlled webhook subscriptions using pre-consented delegated permissions from Microsoft first-party apps such as Microsoft Office, adversaries can redirect live message content—including email previews and full Teams chat bodies—to external endpoints entirely through Microsoft's own infrastructure. No direct access to mailboxes or Teams channels is required after initial token compromise, and no dedicated Entra Admin portal blade exists to surface active subscriptions, making detection extremely difficult without specific KQL queries against Graph Activity Logs. This technique highlights a broader pattern of living-off-the-land cloud attacks where adversaries abuse legitimate platform features—API subscriptions, OAuth tokens, and pre-consented app scopes—to exfiltrate sensitive data while evading traditional DLP and network-based controls. As Microsoft 365 adoption deepens across regulated industries, identity-centric and API-layer attack techniques are rapidly becoming the dominant post-compromise exfiltration vector.
Kill Chain
