GraphFleet Backdoor Hides Hacker Commands Inside Microsoft 365 Calendars

A newly analyzed Windows backdoor is running its entire command-and-control operation through Microsoft 365, hiding instructions in calendar events, Outlook drafts, To Do tasks and OneDrive files instead of talking to an attacker-owned server. Researchers at Rubrik Zero Labs, who published their findings on October 30, 2026, call the malware GraphFleet, and its design is a pointed warning for any business that treats traffic to Microsoft’s cloud as automatically safe.

What GraphFleet Is

GraphFleet is a 64-bit Windows backdoor that belongs to a growing class of malware abusing Microsoft Graph, the API that lets applications read and write Microsoft 365 data. Rubrik named it after its Graph-centric design and a campaign marker, “gcx-fleet-2026-10,” embedded in the binary. Rather than beaconing to a suspicious domain, the implant signs in to Microsoft 365 and collects its orders from objects inside a compromised account.

The key to that access is an OAuth refresh token, a long-lived credential that lets an app sign in without a password. According to Rubrik, GraphFleet presents itself as Microsoft Teams when it uses that token, so its sign-ins look like a routine collaboration app syncing in the background. It saves the newest token in an encrypted local cache tied to the infected machine, so it can survive reboots without re-infection.

Commands Hidden in Calendar Events

The backdoor’s favorite hiding place is the calendar. Each infected computer gets its own calendar event, and commands and results travel as “open extensions,” a Graph feature that attaches small pieces of hidden data to items like events and emails. Rubrik notes that this data does not show up in Outlook or Teams, so a user glancing at the calendar would see nothing unusual.

If the calendar channel fails, GraphFleet rotates through backups in a fixed order: Outlook Drafts, then Microsoft To Do, then a single file in OneDrive. It periodically checks whether the calendar works again and returns to it. Because each host has a unique ID baked into object names, one operator can manage many infected systems through a single account without mixing up their traffic.

What an Attacker Can Do

Once connected, the operator gets broad control. Rubrik’s analysis lists the ability to run hidden shell commands, download files from OneDrive to the victim’s PC, update the implant, load shellcode or executables directly into memory, run scripts in a built-in virtual machine, and set up persistence. User-level persistence uses a logon script value, a Run registry key disguised as “OneDriveSyncSetup,” and a startup-folder script. A more privileged option registers a separate component as a Windows print processor so it can be loaded by the Print Spooler.

A Three-Layer Recovery Plan

What sets GraphFleet apart is how hard it works to keep its access. If its token stops working, it first rechecks its local cache, then downloads a replacement token from a hard-coded SharePoint document. As a last resort, it reads encrypted recovery settings from a smart contract on BNB Smart Chain, a public blockchain, which can point it to new tenant details and a fresh token source.

That recovery path was live. Rubrik reports that the token embedded in the sample it examined was already invalid, but the one pulled from SharePoint worked, returning an access token valid for about two and a half hours along with broad Graph permissions, including sending email, writing to SharePoint and sending Teams messages. The researchers add that the token belonged to Microsoft’s “family of client IDs,” meaning it could also be used through other Microsoft apps such as Office, Azure CLI and Azure PowerShell.

Why It Matters for Business

Most companies allow Microsoft 365 traffic through their firewalls without a second look, because blocking it would halt daily work. GraphFleet exploits exactly that trust. Its network activity goes to Microsoft’s own endpoints, its sign-ins appear as Teams, and its command objects are ordinary-looking calendar entries, drafts and tasks. Traditional defenses that hunt for connections to known-bad servers have little to catch.

It also shifts the security conversation from passwords to tokens. Multi-factor authentication protects the sign-in moment, but a stolen refresh token lets an attacker skip that moment entirely. Rubrik’s own guidance underlines the point: organizations that find GraphFleet artifacts should revoke the refresh tokens of the affected accounts, not just reset passwords. For small and mid-sized businesses that run almost entirely on Microsoft 365, a single compromised mailbox could quietly become a control hub for every infected laptop in the company.

Rubrik acknowledges that the individual techniques have appeared in earlier research, including the use of Outlook tasks and calendar events for command traffic and blockchain contracts for storing malware settings. The concern is the combination: one implant that layers several trusted cloud channels and multiple recovery routes so that losing any single piece does not cut the attacker off.

What Defenders Should Watch For

Rubrik stresses that no single calendar event, draft, task or file is enough to raise an alarm. The signal is the pattern. Its recommendations and indicators point security teams toward several checks:

• Microsoft Teams sign-ins from unexpected devices or locations, especially non-interactive refresh-token activity.
• Calendar events, drafts or To Do tasks with machine-like, host-specific names that recur across accounts.
• Hidden cmd.exe execution and new logon-script, Run-key or startup-folder entries appearing together on endpoints.
• Unexpected print-processor registrations, which can signal the privileged persistence option.
• Endpoint queries to public BNB Smart Chain services from machines with no business reason to reach a blockchain.

Rubrik has published file hashes, the SharePoint tenant used for token drops, the smart contract address and a YARA detection rule in its full report, which security teams can load into their own tools. Reviewing which apps hold long-lived tokens, tightening conditional access policies and shortening token lifetimes where possible are practical steps that limit how long a stolen credential stays useful.

The Bottom Line

GraphFleet shows that an attacker no longer needs their own infrastructure to run a durable backdoor. Microsoft Graph carries the commands, SharePoint and a blockchain contract restore lost access, and Teams-branded sign-ins help it all blend in. For business leaders, the lesson is that cloud trust has to be verified continuously, and that revoking tokens belongs in every incident-response playbook alongside resetting passwords.

Edited by Coron @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous