A reported .NET Native AOT module shifts the communication layer toward Microsoft 365 calendar objects and adds a DNS recovery path, showing how cloud identity surfaces can become part of malware plumbing.