Reputation Radar #3: The Week the Channel Was the Brand

Upfront disclosure: This is written by the small team building Reput.io, not a marketing department. Reputation Radar is our weekly read on the infosec landscape, with a bias toward the thing we care most about: how attackers borrow the reputation of legitimate infrastructure so their traffic looks normal. Every item links the original reporting, and any claim about our own API is run against it live and labelled.

Last week the theme was AI standing up the attack infrastructure. This week it got more literal: the malicious traffic didn't just hide near trusted infrastructure, it flowed through it. The command channel was a Microsoft calendar. The exfil was a Graph API call. The anonymity layer was someone's home internet connection.

When the channel is the brand, the reputation of the destination tells you almost nothing. Here's the week through that lens, then the exploits worth patching regardless.

The C2 was Microsoft the whole time

The one to sit with is HollowGraph, analyzed by Group-IB. It's a Windows implant that uses a compromised Microsoft 365 account's calendar as a two-way dead-drop: the operators plant tasking as calendar events, and the implant exfiltrates stolen files by creating its own events with encrypted data attached. Every event is dated to 13 May 2050 so the mailbox owner never notices. A second channel does DNS tunneling over IPv6 AAAA queries to refresh credentials (Group-IB).

Sit with what that means for triage. The C2 traffic is a genuine Microsoft Graph API call from a genuine Microsoft 365 account. There is no sketchy destination to catch. We ran the Graph endpoint against our own API to make the point honestly:

{ "indicator": "graph.microsoft.com",
  "status": "whitelisted",
  "verdict": "likely_benign",
  "confidence_score": 100 }

That verdict is correct. It really is Microsoft, and marking it anything else would be a false positive on every legitimate Office 365 tenant on earth. Which is exactly the point: destination reputation, done right, still can't see HollowGraph, because the badness is in what the trusted channel is carrying, not in the channel.

The same shape showed up in a takedown. German and US police dismantled Kratos (Microsoft tracks it as SneakyLog), a phishing-as-a-service kit with roughly 1,800 paying customers running about 15,000 campaigns a month. Its interesting mode wasn't the credential-harvesting page, it was a Node.js reverse proxy that relayed the login to Microsoft in real time and captured the resulting session cookie, walking straight past MFA (The Hacker News, on ANY.RUN's reverse-engineering). The relay's destination is the real login.microsoftonline.com, and some of its login pages even loaded a real Cloudflare Turnstile widget to look more legitimate. Our lookup on the challenge host lands where it should:

{ "indicator": "challenges.cloudflare.com",
  "status": "whitelisted",
  "verdict": "investigate" }

Whitelisted for "this is a known Cloudflare property," but investigate, not benign, with the hint we ship on every popularity-only match: popularity alone isn't trust.

"Clean" now means "not yet burned"

The clearest infra-reputation research of the week came from Flare, who read 2,889 underground posts across ~545 threads about how carders actually buy proxies. The takeaway is almost word for word the thing we keep saying: carders no longer treat "residential" as a category you can trust. They split pools into "clean" and "dirty," and judge an IP by its history, whether it's been used against banks and payment processors before, not by whether it belongs to a home ISP (BleepingComputer / Flare).

Flare's own line for defenders: treat residential traffic as context, not evidence that a user is legitimate.

That's the whole game from the other side of the table. The attacker is paying a premium specifically to ride an IP that carries a good reputation, so a lookup that comes back "residential ISP, looks like a normal home user" is the outcome they bought. The residential label is context. It is not a verdict.

Automated, and pointed at the cloud

Two more that show the pattern running at machine speed:

• NadMesh, a Go botnet analyzed by QiAnXin's XLab, ships with 90+ built-in cloud provider address ranges to scan unattended, and uses the Shodan API to hunt specifically for exposed AI services (ComfyUI, Ollama, n8n, Open WebUI) and harvest their cloud keys (XLab). The scanning source and the harvested infrastructure are both mainstream cloud.
• Hugging Face got breached by an autonomous AI agent. A malicious dataset abused two code-execution paths to land on a processing worker, then the agent escalated to node-level access and moved laterally, running "many thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating C2 staged on public services" (The Hacker News). Staging C2 on public services is the reputation move again: short-lived, trusted-hosted, gone before a block list catches up.

Also on the radar

• SharePoint RCE CVE-2026-50522 is under active exploitation (The Hacker News), and CISA added a separate exploited SharePoint zero-day, CVE-2026-58644, to the KEV catalog (The Hacker News). If you run on-prem SharePoint, this is the week's priority.
• Qilin ransomware is exploiting a Palo Alto GlobalProtect VPN bug, CVE-2026-0257 (BleepingComputer).
• CISA ordered urgent patching of actively exploited Fortinet flaws (BleepingComputer).
• A critical NGINX vulnerability can crash workers (The Hacker News) — worth a look if you front services with it.

The through-line for a SOC

Every lead item this week shared one property: the trusted infrastructure wasn't a hiding spot near the attack, it was the delivery mechanism. A Graph API call. A reverse proxy to the real Microsoft login. A residential IP bought precisely for its clean history. A botnet scanning from the same cloud ranges your own services live in.

That's why we keep cloud, CDN, popular domains, and residential ranges at investigate rather than benign, however good the name attached. A destination being real, even being Microsoft, tells you the channel is trustworthy. It doesn't tell you what that channel is carrying, or who's on the other end this time. If you want the longer argument, we made it in why clearing the known-good first is the right triage order.

See you next week.

Sources are linked inline; credit to the original researchers and reporters. If we got a detail wrong, tell us, we'll fix it.