M365Pwned – Red Team GUI Toolkit for Microsoft 365 Exploitation via Graph API

A red teamer operating under the handle OtterHacker has publicly released M365Pwned, a pair of WinForms GUI tools designed to enumerate, search, and exfiltrate data from Microsoft 365 environments using application-level OAuth tokens without requiring any user interaction.

Built entirely in PowerShell 5.1 and leveraging the Microsoft Graph API, the toolkit presents a significant post-compromise offensive capability for penetration testers and adversary simulation operators targeting enterprise M365 tenants.

The toolkit consists of two components — MailPwned-GUI.ps1, targeting Exchange Online and Outlook, and SharePwned-GUI.ps1, targeting SharePoint and OneDrive.

Both tools operate under a registered Azure AD application with admin-consented application permissions and support three authentication methods: Client Secret, Certificate Thumbprint, and Raw Access Token (pass-the-token).