Mass SharePoint/OneDrive Access via python-httpx User Agent

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•0

Detects automated file access and download operations in SharePoint or OneDrive performed by the 'python-httpx' library. This behavior may indicate an attacker using scripts or automated tools to perform unauthorized data collection or exfiltration, often observed in automated cloud compromise scenarios.