GraphWorm Creates a Victim-Specific OneDrive Folder Tree

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•0•0•1

Detects a non-OneDrive process creating files, result, and job subdirectories associated with cloud-hosted tasking, indicative of GraphWorm or similar malware activity leveraging OneDrive for command and control or data staging.