When Backdoors Borrow Trust: Webworm’s Move Into Discord and Microsoft Graph

A suspected espionage cluster is using ordinary cloud services as covert traffic paths, turning familiar collaboration tools into harder-to-see command channels.