The malware is engineered to connect to an adversary-controlled OneDrive account using hard-coded Entra ID (formerly Azure ...