Revoking the token didn’t kill the backdoor
Analysis of the GraphWorm implant shows Webworm operators rotate OAuth credentials to survive token revocation, using OneDrive dead-drop C2 invisible to network defenses.
1
1 stories, newest first · one card per story
Analysis of the GraphWorm implant shows Webworm operators rotate OAuth credentials to survive token revocation, using OneDrive dead-drop C2 invisible to network defenses.
Today 1.6K readers · 2.5K views · 780 reads · all time 189K views