China-Nexus APT Activity

GraphWorm answers token revocation by swapping its own OAuth credentials

CSO Online's teardown of a Webworm implant found an upgrade command that replaces all five credential strings in a single task. The revocation step at the top of most identity runbooks costs the operator one poll cycle.