A China-nexus backdoor called Antino runs its whole C2 through Outlook and OneDrive. It checks the attackers' own mailbox every 10 seconds for commands, via Microsoft Graph. Cisco Talos has the full chain. Every other hop sat on Cloudflare Pages, R2 or CloudFront. Nothing in it is an address you'd think to block. Reputation Radar #14: https://www.reput.io/blog/reputation-radar-14 #ThreatIntel #Microsoft365 #SOC