Automated Python script exfiltration to Microsoft Graph API

Ibrahim Saud@tektrix

•updated Sep 16, 2026•5•1•15

Detects outbound network traffic to Microsoft Graph API originating from a user-agent string identified as 'python-httpx'. This behavior is characteristic of automated scripts or malicious tools using Python libraries to interact with Microsoft cloud services, potentially for data exfiltration or unauthorized API interaction.