← Back to Feed

File Acquisition May Be Recorded as “FileAccessed” in Microsoft 365 (“M365”)

September 24, 2026 · LevelBlue SpiderLabs · Severity: MEDIUM

This article describes a trend where threat actors use phishing and vishing to compromise M365 accounts, then abuse identity tokens and the Microsoft Graph API to automate exfiltration of files from SharePoint, OneDrive, and email. The 'FileAccessed' event may be the only log artifact, complicating detection. The technique represents a shift toward using legitimate APIs for data theft. 📌 **Analyst Note:** Security teams should monitor for unusual patterns of 'FileAccessed' events across multiple users and locations, especially when combined with Graph API calls. Implementing conditional access policies and token binding can help mitigate this abuse of legitimate authentication mechanisms.

A recent trend has emerged where threat actor groups (e.g., ShinyHunters, PEAR, HELIX, etc.) have been leveraging phishing and vishing techniques to gain access to M365 email accounts. Through identity and token abuse, these actors have then automated large-scale file exfiltration and extortion campaigns targeting SharePoint, OneDrive, Microsoft Entra ID (formerly Azure AD), and email data through abuse of the Microsoft Graph API.

Key Takeaways

  • Threat actor groups like ShinyHunters and PEAR are using phishing and vishing to gain access to Microsoft 365 email accounts, then abusing identity tokens to automate large-scale file exfiltration via the Microsoft Graph API.
  • These campaigns target SharePoint, OneDrive, Microsoft Entra ID, and email data, with file acquisition potentially recorded as 'FileAccessed' events, making detection challenging for defenders.
  • The abuse of the Graph API for automated exfiltration represents a significant evolution in post-compromise activity, as it leverages legitimate cloud APIs to blend in with normal traffic.
☕ Buy a Coffee