What is Microsoft 365 malware and why should SMBs care?
Microsoft 365 malware represents a new breed of threat that turns your most trusted business tool into an attack platform. Instead of sending obvious phishing emails or deploying ransomware that locks your files, attackers install malware that communicates through Microsoft Graph, the same API your legitimate apps use to access email, calendars, and files. The result? Command-and-control traffic that looks exactly like normal Microsoft 365 activity.
For a small professional services firm or a mid-sized manufacturer, this matters because your business lives in Microsoft 365. Customer lists, quotes, financial records, project plans, and employee communications all flow through mailboxes and SharePoint. When attackers gain this level of access, they can monitor your business in real time, steal intellectual property, harvest credentials, and prepare for more damaging attacks like wire fraud or ransomware, all while remaining invisible to your IT team.
The HollowGraph malware discovered recently demonstrates the sophistication: it stores stolen data in hidden draft emails and uses Microsoft’s own infrastructure to retrieve commands. No suspicious external connections. No malware signatures that antivirus recognizes. Just patient data theft that can continue for months.
How does this type of attack actually work?
The attack chain starts with a compromised account, often through phishing or credential stuffing. Once inside, the attacker registers a malicious application in your Microsoft 365 tenant or uses stolen API tokens to grant the malware permissions. These permissions let the malware read emails, access files, and modify mailbox settings without needing to repeatedly log in.
HollowGraph, for example, uses Microsoft Graph API calls to create draft emails in specific folders. The malware writes encrypted commands into these drafts, retrieves them through Graph queries, executes the instructions, and then deletes the evidence. To your email server, this looks like a user managing their drafts. To your firewall, it’s legitimate HTTPS traffic to Microsoft’s servers. To your security tools, there’s nothing to flag.
The malware can exfiltrate documents by attaching them to drafts, steal credentials stored in browsers or password managers on infected endpoints, and move laterally to other accounts. Because Microsoft 365 logs API activity but doesn’t alert on every Graph query, the attack stays hidden unless someone is specifically looking for anomalies in mailbox behavior.
What does a breach like this cost a small business?
The financial impact starts with the immediate response. Incident investigation for a mailbox compromise typically runs between $8,000 and $25,000 for an SMB, depending on how many accounts are affected and how long the attacker had access. That includes forensic log review, credential resets, malware removal, and documentation for insurance or regulatory reporting.
If the attacker used mailbox access to launch business email compromise (BEC) fraud, losses escalate quickly. The FBI reports the median BEC loss is $50,000, but many SMBs lose six figures when attackers impersonate executives to redirect wire transfers or payroll deposits. Recovery rates are low, typically under 15% of stolen funds.
Then there’s operational downtime. Remediating compromised Microsoft 365 tenants often requires taking mailboxes offline, forcing password resets across the organization, and reconfiguring app permissions. For a 40-person professional services firm, that’s easily two days of reduced productivity while employees regain access and IT restores normal operations. At an average of $427 per employee per day in lost productivity (based on median SMB labor costs), that’s another $34,000 in hidden costs.
Finally, there’s customer trust. If the breach exposes client data or attackers use your compromised email to target your customers, you face notification obligations, potential liability, and reputational damage that can take years to repair. One Connecticut law firm lost 30% of its client base after a mailbox breach led to a secondary phishing campaign targeting their clients.
Do standard Microsoft 365 protections stop this?
Microsoft 365 Business Premium and Enterprise plans include Exchange Online Protection, Microsoft Defender for Office 365, and some automated threat detection. These tools block many phishing emails and flag suspicious login attempts. But they’re not designed to catch malware that uses legitimate APIs with valid credentials.
The challenge is that Microsoft Graph access is how modern cloud apps work. Your CRM, your document signing tool, your HR platform, they all use Graph to integrate with email and files. Blocking Graph traffic would break your business applications. Instead, you need visibility into which apps have what permissions, monitoring for unusual API patterns, and alerting when draft folders or mailbox rules change unexpectedly.
Most SMBs don’t have the in-house expertise to configure these advanced detection capabilities. Microsoft’s tools can do it, but they require tuning, baseline establishment, and daily log review. Without that human layer, the malware operates undetected until something else goes wrong, like a ransomware deployment or a customer reporting a suspicious email from your domain.
How can SMBs detect and prevent Microsoft 365 malware?
Detection starts with mailbox auditing. Enable unified audit logging in your Microsoft 365 admin center and configure alerts for specific events: new inbox rules created, especially those that forward or delete messages; changes to mailbox delegation or folder permissions; unusual volumes of draft emails being created or modified; and API access from unfamiliar applications or IP addresses.
Review application permissions quarterly. In the Azure Active Directory portal, check which third-party apps have access to your tenant and what permissions they hold. Remove apps you no longer use and downgrade permissions that seem excessive. If an app requests full mailbox access when it only needs calendar integration, that’s a red flag.
Implement conditional access policies that require multi-factor authentication (MFA) for all users, especially administrators. While MFA doesn’t stop malware that already has API tokens, it prevents the initial account compromise that lets attackers install the malware in the first place. Pair MFA with impossible travel alerts that flag logins from geographically distant locations within short time windows.
For prevention, educate your team on phishing, especially attacks that request OAuth consent. These are the phishing emails that don’t ask for passwords but instead say “Click here to grant this app access to your calendar.” Once a user clicks Allow, the malicious app has legitimate API access without needing credentials. Train employees to verify app requests with IT before granting permissions.
Finally, consider partnering with a managed security provider who monitors your Microsoft 365 environment specifically for these advanced threats. Most SMBs don’t have the staffing to review audit logs daily or the expertise to distinguish normal API activity from malicious patterns. A security-focused MSP watches for the indicators that standard tools miss.
What should you do if you suspect a compromise?
If you see signs of unusual mailbox activity, like missing emails, unexpected inbox rules, or reports of suspicious messages sent from your accounts, act immediately. Start by documenting what you observe: screenshot any strange rules, note which accounts are affected, and preserve any suspicious emails before they’re deleted.
Reset passwords for affected accounts and revoke all active sessions. In the Microsoft 365 admin center, you can force sign-out across all devices. Enable MFA immediately if it’s not already in place. Review and revoke application permissions, especially for apps you don’t recognize or that were recently added.
Run a full endpoint scan on any computers used by compromised accounts. If the malware originated from an infected workstation, it may have left keyloggers or additional payloads that will re-compromise the mailbox as soon as the user logs back in.
Check your audit logs for the full scope of attacker activity. Look at what emails were accessed, what files were downloaded, and whether any financial systems or customer databases were queried. If the compromise involved customer data or financial information, consult with legal counsel about notification obligations and breach reporting.
For businesses facing a potential data breach, the first 48 hours are critical for containment. Professional incident response reduces both the technical damage and the regulatory exposure.
Is this threat going to get worse?
Yes. As Microsoft 365 adoption grows among SMBs and more business processes move into the cloud, attackers follow. The tools to abuse Microsoft Graph and other cloud APIs are becoming more accessible, with ready-made malware kits available on dark web forums for a few hundred dollars.
At the same time, artificial intelligence makes it easier for attackers to automate reconnaissance and payload delivery. LLMs can generate convincing phishing emails tailored to your industry, analyze your public LinkedIn profiles to craft targeted pretexts, and even script malware that adapts based on the environment it finds.
The good news is that defensive tools are also improving. Microsoft continues adding detection capabilities, security vendors are building better cloud monitoring solutions, and awareness is growing. But small businesses remain the most vulnerable because they often lack dedicated IT security staff and assume cloud providers handle all the security.
For professional services firms and manufacturers in Connecticut and beyond, the message is clear: Microsoft 365 security is no longer optional or something you set once and forget. It requires active monitoring, regular reviews, and honest conversations about whether your current approach matches the threat landscape.
What does good Microsoft 365 security look like for an SMB?
A solid security posture starts with the basics: MFA everywhere, regular password changes enforced through policy, and mailbox auditing turned on. From there, add conditional access rules that block legacy authentication protocols and require device compliance checks before granting access.
Layer in email filtering beyond Microsoft’s built-in protections. Third-party tools from vendors like Proofpoint, Mimecast, or Barracuda add additional phishing detection and sandboxing for attachments. While they cost extra, they catch threats that slip through Exchange Online Protection.
Invest in security awareness training that goes beyond annual compliance checkboxes. Monthly phishing simulations, real-world examples from recent breaches, and quick reference guides for spotting OAuth phishing make your team the strongest part of your defense. One Connecticut accounting firm reduced successful phishing clicks by 85% after implementing quarterly interactive training.
Budget for log monitoring and threat detection, either through your own SIEM (Security Information and Event Management) tool or through a managed service. Logs are worthless if no one reads them. Regular reviews catch unusual patterns before they become breaches.
Finally, plan your incident response before you need it. Document who to call, what systems to isolate first, and how to communicate with customers if a breach occurs. Partnering with an MSP that specializes in security means you have that expertise on speed dial when minutes matter.
Microsoft 365 malware isn’t going away. But with the right combination of technology, training, and monitoring, SMBs can reduce their exposure and detect attacks before they cause lasting damage. The cost of prevention is always less than the cost of recovery.
Keep reading
- businesses facing a potential data breach
- professional services firms
- manufacturers
- Partnering with an MSP that specializes in security
Sources
Source: New HollowGraph malware uses Microsoft Graph for stealthy C2 comms