GoGra uses OAuth tokens to blend into normal Office 365 traffic, making detection difficult for signature based security tools.