HollowGraph Malware: Hackers Are Hiding Inside Microsoft 365 Calendar Invites

Security researchers have uncovered a strikingly creative piece of espionage malware that turns an everyday Microsoft 365 calendar into a covert command-and-control channel. Dubbed HollowGraph, the malware hides attacker instructions and stolen data inside calendar events scheduled 24 years in the future — May 13, 2050 — where no one would ever think to look.

The discovery, published July 20, 2026 by threat intelligence firm Group-IB, reveals a technique that sidesteps traditional network defenses entirely. Because the malicious traffic flows through Microsoft’s own legitimate cloud infrastructure, there’s no suspicious external server for security tools to flag — and no software vulnerability to patch.

How HollowGraph Turns a Calendar Into a Dead Drop

HollowGraph is a lightweight .NET-based implant that supports just two commands: get and send. Rather than contacting an attacker-owned server the way most malware does, it authenticates to the Microsoft Graph API using stolen Microsoft Entra ID (Azure AD) credentials and treats the compromised mailbox’s calendar as a two-way “dead drop.”

To receive instructions, the malware searches the calendar for an event titled “Event ID: [task ID]” scheduled for that same fixed 2050 date, then downloads and decrypts an attached file containing its orders. To exfiltrate stolen data, it does the reverse — encrypting files with a hybrid RSA and AES-256 scheme, attaching them to a new calendar event, and renaming the event subject to an operator-recognizable tag before the attacker retrieves it later.

A separate, second channel handles credential renewal: HollowGraph performs DNS tunneling through specially encoded IPv6 queries to a domain called cloudlanecdn[.]com, refreshing its Azure authentication tokens and writing them to a disguised local file named logAzure.txt.

Who’s Behind It, and Who’s Being Targeted

Group-IB attributes HollowGraph, with high confidence, to a broader espionage toolkit called the Cavern framework — based on matching command syntax and self-command codes recovered from the malware. Researchers also identified technical overlaps with Lyceum, an Iranian-nexus threat actor tied to Iran’s Ministry of Intelligence and considered a sub-group of OilRig, though that specific connection is held at only low confidence.

The campaign appears to be narrowly targeted rather than opportunistic. Group-IB identified 12 infected systems, with the earliest observed victim communication dating to June 3, 2026 and the most recent to July 9. Only about three of those systems were actively exchanging data with the attacker during the observation window — a pattern the researchers describe as a “disciplined operational approach” focused specifically on Israeli organizations, based on the compromised mailbox and malware samples both originating from Israel.

Why This Technique Is So Hard to Detect

What makes HollowGraph notable isn’t its sophistication in the traditional sense — it’s the choice of hiding spot. There’s no malicious IP address to block, because every request goes to Microsoft’s own servers. There’s no unusual port or protocol to flag, because it’s ordinary HTTPS traffic to a trusted domain. And there’s no software flaw to patch, because the malware is abusing legitimate Graph API functionality exactly as designed — it just requires a compromised account to do it.

This puts the burden of detection squarely on identity security and behavioral monitoring rather than traditional perimeter defenses like firewalls or antivirus signatures — a pattern that’s becoming increasingly common as attackers shift toward abusing trusted cloud platforms instead of building their own infrastructure.

How to Protect Your Organization From HollowGraph

Based on Group-IB’s official recommendations, here’s what security and IT teams should do:

1. Hunt for the specific indicators: Search your Microsoft 365 environment for calendar events dated 2050-05-13, subjects containing “Event ID:” or matching the “Boss{..}ID{..}” pattern, and file attachments named “File{n}.txt” — these are HollowGraph’s fingerprints.
2. Monitor Graph API and mailbox audit logs: Watch specifically for calendar operations — event creation, attachment uploads, subject changes — performed by an application rather than a human user.
3. Audit OAuth2 client-credential applications: Restrict and closely monitor applications using client-credential authentication, and alert immediately on the creation of new client secrets.
4. Enforce Conditional Access and credential rotation: Apply Conditional Access policies and anomalous-token detection across Microsoft 365 and Entra ID environments, and rotate credentials on a regular schedule.
5. Deploy DNS tunneling detection: Watch for unusually frequent AAAA (IPv6) DNS queries and high-entropy subdomains, and block the known malicious domain cloudlanecdn[.]com at the DNS resolver level.

Frequently Asked Questions

🚨 ENTERPRISE APT DEFENSE DIRECTIVE:
To combat sophisticated nation-state actors and geopolitical cyber espionage across your enterprise infrastructure, continuous monitoring is critical. Explore verified defensive blueprints, real-time IOCs, and zero-trust mitigation architectures within our canonical intelligence repository: The 2026 Nation-State APT & Cyber Security Threat Monitoring Vault.

Reported by CyberUpdates365 Desk

Delivering the latest insights on enterprise security, federal AI directives, and the future of IT infrastructure. Follow us for daily updates on how technology is reshaping the corporate landscape.