HollowGraph espionage malware uses Microsoft 365 calendars as covert command-and-control

What Happened On July 20, 2026, cybersecurity firm Group-IB disclosed a new espionage implant dubbed HollowGraph that hijacks compromised Microsoft 365 mailboxes to run a command-and-control (C2) channel hidden inside calendar events. The malware attaches encrypted files to calendar entries dated May 13, 2050 — far enough in the future that a mailbox owner would never scroll to them — and retrieves operator instructions from the same dead drop. All traffic moves through the Microsoft Graph API, making the activity indistinguishable from legitimate M365 usage. At least 12 systems have been infected, with three actively communicating with the threat actor between June 3 and July 9, 2026. The indicators point to a targeted espionage campaign focused on Israeli organizations. Technical Analysis HollowGraph is a lightweight .NET DLL that supports only two commands: GET and SEND. To receive tasking, it queries the compromised mailbox's calendar for an event titled in the format "Event ID: <7-char-taskID>", downloads the attached file, and decrypts it using RSA and AES-256-GCM. To exfiltrate data, the implant creates a new calendar entry titled "Boss{..}ID{..}" and uploads stolen files encrypted with the attacker's public RSA key. The Group-IB research team described the mailbox calendar as a "covert dead-drop," with HollowGraph retrieving commands from events scheduled within a fixed one-hour window between 22:00 and 23:00 UTC on the far-future date. The hybrid encryption scheme uses separate RSA key pairs for inbound and outbound channels, keeping them cryptographically isolated. A second, unencrypted channel runs over DNS tunneling. HollowGraph refreshes its Microsoft Entra ID (Azure AD) credentials by querying IPv6 AAAA records from the attacker-controlled domain cloudlanecdn[.]com. Each returned IPv6 address yields 14 usable payload bytes, which the malware assembles and decodes as UTF-8 text to update its logAzure.txt configuration file — a file masquerading as a routine log entry. Group-IB assessed with high confidence that HollowGraph is linked to the Cavern backdoor framework, a modular C2 toolkit previously connected to Iranian-nexus activity. While technical similarities to the Lyceum threat actor were noted, the evidence is insufficient for a definitive attribution. Who's Affected The campaign targets organizations using Microsoft 365, with indicators pointing specifically to entities in Israel. Any enterprise relying on M365 calendar and Graph API integrations is exposed to this attack vector. The technique is not limited to a single vertical — the attacker specifically chose Microsoft cloud infrastructure because its API traffic blends into normal corporate usage patterns. The real danger is that traditional network security controls keyed to attacker-owned destinations have nothing to flag. All data flows through Microsoft's legitimate cloud endpoints, making detection significantly harder than conventional C2 channels. How to Protect Yourself Monitor Microsoft 365 audit logs for suspicious application-driven calendar activity, especially events in the far future or with unusual subjects and attachments. Hunt for the logAzure.txt file across endpoints and investigate any OAuth client-credential applications that appear unauthorized. Enforce Conditional Access policies and restrict OAuth app registrations to approved publishers only. Monitor outbound DNS for tunneling patterns — particularly unusual IPv6 AAAA record queries to domains like cloudlanecdn[.]com. Audit Microsoft Graph API permissions and regularly review which applications have mailbox access. The Sable Angle HollowGraph is a textbook example of how modern attackers weaponize trusted cloud infrastructure. At Sable, our offensive research team regularly maps these blind spots for enterprise clients — testing whether their detections catch API-based C2, DNS tunneling, and credential rotation hiding in plain sight. Our platform can simulate adversary-in-the-middle techniques that abuse legitimate SaaS APIs, helping security teams validate their detection coverage before a real Iranian-nexus APT group targets their mailbox. Learn more about our approach at /research/openclaw.

A malicious component dubbed HollowGraph uses the calendar feature in compromised Microsoft 365 mailboxes as a command-and-control channel to receive attacker commands and exfiltrate stolen data. [...]

Microsoft 365 calendars have become a hiding place for espionage malware, with commands and stolen files stashed inside appointments dated to the year 2050, researchers from Group-IB discovered. Targeted campaign tied to Iranian espionage activity The malware, which Group-IB calls HOLLOWGRAPH, is one component of a bigger toolkit the company links with high confidence to the Cavern backdoor framework, a modular espionage toolkit built from separate plugins that each handle a different task, previously tied … More → The post HOLLOWGRAPH malware turns Microsoft 365 calendars into an espionage channel appeared first on Help Net Security.

Malware hides commands in appointments set for 2050 and uses Redmond's own cloud to phone home

A newly discovered espionage implant has been using a hijacked Microsoft 365 calendar as its command channel, planting operator instructions and smuggling out stolen files as attachments on calendar events dated to the year 2050. Group-IB, which named the malware HollowGraph, says the approach moves tasking and stolen data through legitimate Microsoft Graph API traffic, so the activity looks

Researchers have linked HollowGraph malware to the Cavern framework after discovering its use of Microsoft 365 calendars and Microsoft Graph APIs as a stealthy C2 channel