OilCheck can upload documents from compromised hosts to a shared Microsoft Office 365 Outlook email account for exfiltration.^[1]

OilCheck can download staged payloads from an actor-controlled infrastructure.^[1]

OilCheck can use a REST-based Microsoft Graph API to access draft messages in a shared Microsoft Office 365 Outlook email account used for C2 communication.^[1]

^[1]