China-nexus group MURKY PANDA is conducting sustained espionage campaigns against Microsoft 365 environments at financial institutions, exploiting OAuth application consent abuse, mail rule creation, and bulk data repository access to exfiltrate sensitive financial and organizational data. No Microsoft CVE is associated with this campaign; the attack surface is configuration and identity posture, not unpatched software.