RSS
The China-based threat group uses DLL sideloading in these attacks
Automated sign-ins used the vendor's Entra application identity to request Microsoft Graph tokens across consenting tenants