GraphSpy
GraphSpy is a browser-based post-exploitation tool for Azure Active Directory and Office 365 environments that enables token management, reconnaissance, and interaction with Microsoft 365 services.
GraphSpy is a browser-based post-exploitation tool for Azure Active Directory and Office 365 environments that enables token management, reconnaissance, and interaction with Microsoft 365 services.
Checked October 2026.
GraphSpy is a browser-based post-exploitation tool designed for Azure Active Directory and Office 365 environments. The tool provides security professionals with capabilities to manage access tokens, perform reconnaissance, and interact with Microsoft 365 services after gaining initial access to target systems.
The tool offers comprehensive token management functionality, allowing users to store and manage access and refresh tokens for multiple users and scopes. It supports device code authentication flows and provides capabilities to manipulate multi-factor authentication methods for maintaining persistence in compromised environments.
GraphSpy includes several modules for post-exploitation activities across Microsoft 365 services. The file access module enables interaction with OneDrive and SharePoint, providing download and upload capabilities for document manipulation. Email functionality allows access and manipulation through Outlook using either direct web access or Graph API integration.
The tool supports Microsoft Teams message reading and sending, Graph API searching across Microsoft 365 applications, and custom API request capabilities with template storage for repeated operations. It includes Entra ID user enumeration features for gathering detailed user information during reconnaissance phases.
GraphSpy operates as a local web application accessible through standard web browsers, supporting both light and dark modes for user preference. The tool can be installed via pipx and functions across multiple operating systems, with primary testing conducted on Linux and Windows platforms. It supports multiple database configurations to organize tokens and device codes for different assessment engagements.
No core features are listed for this product yet, so check the vendor's documentation for the full feature list.
No integrations are listed for this product yet. Check the vendor's documentation, or ask the vendor which integrations and APIs it supports.
Common questions about GraphSpy: features, pricing and alternatives.
GraphSpy is a product in the Red-Team & Adversary Emulation category. It covers Post Exploitation, Azure and Reconnaissance.
GraphSpy is free. Download and setup instructions are at https://github.com/RedByte1337/GraphSpy/.
Alternatives to GraphSpy listed on CybersecTools:
Compare all GraphSpy alternatives at https://cybersectools.com/alternatives/graphspy
GraphSpy is available as on-premises software. It is listed for mid-market companies and enterprises. It is free.
Side by side: features, pricing model and the company behind each one.
A tool that generates .NET serialized gadgets for triggering assembly load and execution through BinaryFormatter deserialization in JavaScript, VBScript, and VBA scripts.
A featured networking utility for reading and writing data across network connections with advanced capabilities.
Human-led adversary emulation service testing detection & response capabilities
Open-source C2 framework for red team ops and adversary simulation.
MCP server enabling AI agents to autonomously run 150+ security tools
Learn how to create new Malleable C2 profiles for Cobalt Strike to avoid detection and signatured toolset
Get a summary of this page from your assistant.
Mandos MCP: ask about all 9,030 products.
Connect your AI
