You've Got (Graph) Mail: How Attackers Are Silently Exfiltrating Microsoft 365 Data via Graph API Webhooks
Executive Summary
Executive Summary In November 2026, NetSPI disclosed a post-exploitation data exfiltration technique leveraging Microsoft Graph API Change Notifications (Rich Notifications) to silently siphon Outlook emails and Microsoft Teams messages from compromised Microsoft 365 tenants. By registering attacker-controlled webhook subscriptions using pre-consented delegated permissions from Microsoft first-party apps such as Microsoft Office, adversaries can redirect live message content—including email previews and full Teams chat bodies—to external endpoints entirely through Microsoft's own infrastructure. No direct access to mailboxes or Teams channels is required after initial token compromise, and no dedicated Entra Admin portal blade exists to surface active subscriptions, making detection extremely difficult without specific KQL queries against Graph Activity Logs.
This technique highlights a broader pattern of living-off-the-land cloud attacks where adversaries abuse legitimate platform features—API subscriptions, OAuth tokens, and pre-consented app scopes—to exfiltrate sensitive data while evading traditional DLP and network-based controls. As Microsoft 365 adoption deepens across regulated industries, identity-centric and API-layer attack techniques are rapidly becoming the dominant post-compromise exfiltration vector.
Why This Matters Now
Why This Matters NowMicrosoft 365 is the backbone of enterprise communication for hundreds of millions of users, and Graph API Rich Notifications expose a covert, low-visibility exfiltration channel that bypasses conventional DLP tools. With the GraphNotificationsActivityLogs table only added in July 2026—years after the technique was first identified—most organizations lack the logging infrastructure and detection logic to identify active webhook subscriptions silently harvesting employee emails and Teams messages today.
Attack Path Analysis
Attack Path AnalysisAn attacker targeting a Microsoft 365 tenant first compromised a user or service principal account through phishing, token theft, or device code authentication abuse, obtaining valid OAuth tokens scoped to the Microsoft Graph API. Using pre-consented permissions available from Microsoft first-party applications (e.g., Microsoft Office FOCI client), the attacker escalated effective access to sensitive Graph API scopes including Mail.Read and Chat.Read without requiring additional consent. No meaningful lateral movement within cloud infrastructure was required, as the Graph API itself provided tenant-wide resource access when application-level permissions were involved. The attacker established a covert command-and-control channel by registering Microsoft Graph API Change Notification subscriptions pointing to an attacker-controlled external webhook, with Microsoft infrastructure acting as the unwitting delivery mechanism. Rich Notifications continuously pushed encrypted email and Teams message content to the attacker's webhook, bypassing traditional DLP controls since the data transited through Microsoft's own infrastructure. The sustained, near-real-time exfiltration of sensitive communications represents significant business impact including credential theft, intellectual property loss, and compliance violations.
Kill Chain Progression
Kill Chain ProgressionThis analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
DescriptionThe attacker obtained valid OAuth access and refresh tokens for the Microsoft Graph API by abusing the device code authentication flow targeting a compromised user, or by compromising a service principal with Graph API permissions. Tools such as roadtx (ROADtools) were used to authenticate via device code login against Microsoft first-party application client IDs (e.g., Microsoft Office, d3590ed6-52b3-4102-aeff-aad2292ab01c) that carry pre-consented Graph API scopes, eliminating the need to trigger additional consent prompts.
MITRE ATT&CK® Techniques
MITRE ATT&CK® TechniquesSteal Application Access Token
Valid Accounts: Cloud Accounts
Data from Cloud Storage
Exfiltration Over Web Service: Exfiltration to Cloud Storage
Email Collection: Remote Email Collection
Data from Information Repositories: Code Repositories
Use Alternate Authentication Material: Application Access Token
Account Manipulation: Additional Cloud Roles
Potential Compliance Exposure
Potential Compliance ExposureMapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev 5 – Audit Record Generation and Review
Control ID: AU-12, AU-6
PCI DSS 4.0 – Access Control and Audit Log Management
Control ID: Requirement 7.2, Requirement 10.2
NYDFS 23 NYCRR 500 – Monitoring and Access Privileges
Control ID: 500.14(b), 500.06
DORA (EU 2022/2554) – ICT Security Controls and Continuous Monitoring
Control ID: Article 9(2), Article 10
NIS2 Directive (EU 2022/2555) – Incident Handling and Access Control Measures
Control ID: Article 21(2)(b), Article 21(2)(e)
CISA Zero Trust Maturity Model 2.0 – Continuous Authorization and Data Exfiltration Prevention
Control ID: Identity Pillar – Authorization; Network Pillar – Data Flow Mapping
Sector Implications
Sector ImplicationsIndustry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Financial Services
Cloud credential abuse via Microsoft Graph API Rich Notifications enables covert exfiltration of sensitive Outlook and Teams communications, bypassing DLP controls critical to PCI 4.0 and NIST.800-53 compliance obligations.
Information Technology/IT
Compromised service principals with Chat.Read.All permissions allow org-wide Teams message exfiltration through Microsoft infrastructure, evading egress security and multicloud visibility controls mapped to ZTMM.Data frameworks.
Health Care / Life Sciences
Graph API Change Notification abuse exposes PHI transmitted via Outlook and Teams, violating HIPAA 164.312(e)(1) and 164.308(a)(6) where egress policy enforcement and anomaly detection gaps exist post-compromise.
Government Administration
Minimal Entra Admin portal visibility into Graph subscriptions enables persistent, covert data exfiltration of sensitive communications, undermining NIST CSF PR.DS-5 and zero trust segmentation mandates for public sector environments.
Sources
Sources- You’ve Got (Graph) Mail – Leveraging Microsoft Graph API Change Notifications for Data Exfiltrationhttps://www.netspi.com/blog/technical-blog/cloud-pentesting/leveraging-microsoft-graph-api-change-notifications-for-data-exfiltration/Verified
- Microsoft Graph Change Notifications Overview - Microsoft Documentationhttps://learn.microsoft.com/en-us/graph/change-notifications-overviewVerified
- Microsoft Graph Activity Logs - Microsoft Documentationhttps://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-microsoft-graph-activity-logsVerified
- GraphNotificationsActivityLogs Table Reference - Microsoft Documentationhttps://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/graphnotificationsactivitylogsVerified
- ROADtools - Azure AD Exploration Framework (roadtx token acquisition reference)https://github.com/dirkjanm/ROADtoolsVerified
- Nathan McNulty on Graph Webhooks and M365 Change Notifications (Twitter/X)https://x.com/NathanMcNulty/status/1860596552433062035Verified
- M365Permissions PowerShell Tool by Jos Liebenhttps://www.powershellgallery.com/packages/M365PermissionsVerified
- Microsoft Entra Scopes App - Fabian Bader and Dirk-jan Mollemahttps://entrascopes.com/Verified
Frequently Asked Questions
Frequently Asked QuestionsCloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
This attack exploited Microsoft Graph API OAuth flows and Change Notification subscriptions to silently exfiltrate Teams and Outlook data entirely through Microsoft-managed infrastructure, making cloud network visibility and egress control critical. Aviatrix Zero Trust CNSF would likely reduce attacker reach by constraining outbound webhook registration paths and limiting the reachability of compromised identities across workload boundaries.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Enforcing identity-aware network segmentation across cloud workloads would likely reduce the reachability of compromised service principals to sensitive API endpoints, constraining the blast radius of token theft before Graph API abuse could be established.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely constrain the scope of privilege abuse by reducing which workloads can assume or exercise broad Graph API application permissions, limiting how far a compromised identity can reach across tenant resources without crossing an enforced policy boundary.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement would likely reduce the ability of a compromised workload identity to freely communicate with tenant-wide resource APIs, constraining implicit access paths that bypass conventional workload-to-workload movement and limiting the logical reach achievable from a single compromised principal.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility and control would likely surface anomalous outbound subscription registration traffic destined for external webhook endpoints, reducing the attacker's ability to maintain a covert C2 channel that appears as benign Microsoft Graph API activity without detection or policy challenge.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security and policy enforcement would likely reduce the attacker's ability to freely route sensitive data payloads to external attacker-controlled webhook endpoints, constraining the outbound paths available for Graph-delivered notification traffic destined outside sanctioned organizational infrastructure.
Where earlier CNSF controls would likely have reduced the attacker's outbound reach and workload access scope, residual impact would likely be narrower in blast radius, affecting fewer tenant resources and reducing the volume of sensitive communications exposed before detection became actionable.
Impact at a Glance
Affected Business Functions
- Corporate Email Communications (Outlook / Exchange Online)
- Unified Communications and Messaging (Microsoft Teams)
- Cloud Identity and Access Management (Entra ID / Azure AD)
- Data Loss Prevention and Compliance Monitoring
Estimated downtime: N/A
Estimated loss: N/A
This technique enables real-time exfiltration of sensitive corporate communications including: full Microsoft Teams chat message bodies across an entire organization when a privileged service principal is compromised (via Chat.Read.All application permission); Outlook email subject lines, sender/recipient metadata, and up to 255-character body previews (bodyPreview) per message for compromised user accounts; and potentially full email body reconstruction via draft message manipulation. Data at risk includes credentials, strategic business discussions, PII shared in emails or chats, financial information, and any sensitive content communicated over Teams or Outlook. In an application-level compromise scenario with Chat.Read.All, all Teams messages across the entire tenant are at risk of continuous exfiltration for up to 3 days per subscription window, renewable indefinitely with persistent access. The exfiltration channel leverages Microsoft's own infrastructure, bypassing traditional network-based DLP controls.
Recommended Actions
Key Takeaways & Next Steps
- • Enforce Egress Security & Policy Enforcement (CNSF): Deploy egress filtering and FQDN-based outbound policy controls to detect and block unauthorized outbound webhook registrations to unknown or unwhitelisted external endpoints; Microsoft Graph Change Notification subscriptions pointing to attacker-controlled Azure Function Apps or external URLs should be identified and blocked at the network egress layer before data leaves the environment, directly mitigating the exfiltration channel.
- • Enable Multicloud Visibility & Control (CNSF): Activate Microsoft Graph Activity Logs (MicrosoftGraphActivityLogs) and the new GraphNotificationsActivityLogs table, and integrate these into a centralized SIEM with anomaly detection rules targeting POST requests to /v1.0/subscriptions and /beta/subscriptions from unexpected principals, unusual notificationUrl destinations, and high-frequency Rich Notification triggers; CNSF multicloud visibility capabilities should correlate these signals across the M365 and Azure control plane.
- • Apply Zero Trust Segmentation & Least Privilege (CNSF): Audit and restrict delegated and application Graph API permissions across all service principals and first-party application consent grants; revoke over-permissioned scopes such as Chat.Read.All and Mail.Read.All where not operationally required, enforce conditional access policies blocking device code authentication flows, require MFA for all users and applications, and enforce compliant device requirements to prevent the initial token theft that enables this attack chain.
- • Deploy Cloud Firewall (ACF) with URL Filtering (CNSF): Implement cloud-native firewall controls with URL/FQDN filtering to identify and alert on outbound HTTPS connections from cloud workloads to unexpected webhook destinations, particularly dynamic Azure-hosted function apps or external domains not in an approved allowlist; this layer can detect and block the registration and ongoing use of attacker-controlled webhook infrastructure used as the C2 and exfiltration endpoint.
- • Leverage Threat Detection & Anomaly Response (CNSF): Establish behavioral baselines for Microsoft Graph API subscription activity per user and service principal, and configure automated alerting for anomalous subscription creation events, unexpected includeResourceData=true parameters, subscriptions targeting non-organizational notificationUrl domains, or subscription renewal patterns indicative of persistent attacker access; integrate incident response runbooks to automatically revoke active subscriptions and invalidate refresh tokens upon detection.
