Group-IB has uncovered a targeted malware campaign, dubbed HOLLOWGRAPH, that uses compromised Microsoft 365 calendars as a stealthy command-and-control channel, burying encrypted tasking in appointments dated May 13, 2050. First reported by The Register on July 20, 2026, the operation avoids detection by blending into legitimate Microsoft Graph API traffic, leaving no obvious signs for traditional network defenses. For Microsoft 365 admins, the discovery is a blunt reminder: the cloud services you trust are now the adversary’s playground, and your monitoring strategy must adapt.

How the Malware Hides in Plain Sight

The implant, described by Group-IB as a lean Windows component, does not phone home to a suspicious IP address. Instead, it reads instructions from a calendar event in a compromised Microsoft 365 mailbox and writes harvested files into new appointments for an operator to collect later. Every event it creates is stamped with a distant future date—May 13, 2050—tucking them far from the prying eyes of daily calendar views. The content is further obscured: commands and exfiltrated data are encrypted with a hybrid of RSA and AES-256-GCM, meaning even an admin who stumbles onto the entries will see only gibberish.

The malware acquires its access through valid credentials, not a software flaw. It uses the Microsoft Graph API with permissions already present on the mailbox—typically Calendars.ReadWrite or broader Exchange-level grants—and its requests look indistinguishable from any other cloud-connected application. Because Microsoft 365 is a trusted destination, proxy rules that block unknown domains are useless. The traffic is simply “normal API traffic to Microsoft,” which most organizations allow by default.

To keep its access alive, HOLLOWGRAPH uses a secondary channel: DNS tunneling. Group-IB says the implant periodically refreshes its Entra ID credentials by sending requests through DNS, a method that often flies under the radar if recursive DNS logs are not scrutinized. Unlike the calendar channel, this DNS traffic is not encrypted, presenting a potential detection opportunity—provided security teams are actually looking.

What This Means for Your Organization

The immediate risk depends heavily on your role and vertical. For most home users and small businesses, HOLLOWGRAPH is not an imminent threat. The campaign appears to be a narrowly targeted espionage operation aimed at Israeli entities, with only 12 infected systems identified and just three observed communicating with the compromised mailbox during Group-IB’s analysis. However, the techniques are transferable, and the broader lesson is critical for any organization running Microsoft 365.

For IT and security administrators, the implications are stark. A conventional endpoint clean-up is insufficient if the attacker retains control over the identity, its OAuth tokens, or the application permissions that allow calendar manipulation. This is an identity-first incident. The malware does not exploit a vulnerability that Microsoft can patch; it abuses legitimate features and trust relationships. Defenders must therefore shift their thinking from “did someone download a weird file?” to “is a trusted API performing unexpected actions on a mailbox?”

Developers and architects should note how easily a well-intentioned API like Microsoft Graph can be weaponized. Applications with broad read/write access to calendars are common in productivity and scheduling tools. HOLLOWGRAPH underscores the need for least privilege, rigorous app governance, and continuous review of consent grants.

The Road to Cloud-Native Espionage

Using legitimate cloud services as a command-and-control middleman is not new. Attackers have previously abused Google Drive, Dropbox, and even Twitter for similar ends. HOLLOWGRAPH, however, takes the concept deeper by leveraging a business-critical platform—Microsoft 365—and a feature that is mundane and rarely inspected: the calendar. The future-dating trick is a clever concealment method, but it’s the integration of DNS tunneling for credential refresh that marks a notable evolution. Together, these elements create a resilient, low-visibility communication chain that is difficult to sever.

Group-IB first spotted the malicious activity on June 3, 2026, and continued observation through July 9. The firm linked the malware to the Cavern framework with high confidence, based on matching command structures. A weaker connection, with low confidence, was noted with Lyceum, an Iranian-linked espionage actor. Regardless of attribution, the campaign’s focus on Israeli targets and the small number of affected systems point to a classic espionage play, not a broad smash-and-grab.

Microsoft, for its part, has not issued an emergency fix because there is no vulnerability in Graph or Exchange Online to correct. The company’s advisory role, for now, will likely center on detection guidance—something its own documentation and tools like Microsoft Purview and Defender for Cloud Apps are already equipped to support, provided administrators configure them correctly.

Your Action Plan: Hunting and Hardening

If you suspect a compromise or simply want to strengthen your posture against similar cloud-abuse techniques, the following steps will help. None require an emergency patch, but they do require a disciplined investigation across identity, cloud, and endpoint logs.

1. Hunt for Anomalous Calendar Items
Start with Microsoft Purview Audit. The Create event for calendar items is logged under standard mailbox audit settings (generally retained for 180 days). Search for patterns that depart from your organization’s norms: events set decades in the future, encrypted or suspicious attachments, calendar entries created by unfamiliar application identities rather than users, and actions occurring at odd hours. While HOLLOWGRAPH used May 13, 2050, a future attacker could pick any date, so cast a wide net.

2. Review Entra ID and OAuth Applications
Inventory all enterprise applications with Calendars.ReadWrite or broader Exchange permissions. Use Microsoft Defender for Cloud Apps (App governance) or the Azure portal to identify apps that lack a business owner, have tenant-wide consent, or whose publisher and purpose are unknown. Check recent consent grants, newly registered apps, and service principals associated with high-risk users.

3. Correlate with DNS and Endpoint Telemetry
Because HOLLOWGRAPH uses DNS tunneling to refresh credentials, your recursive DNS logs are invaluable. Look for unusual query patterns—long labels, bursts of TXT or CNAME records directed at unknown domains, or queries that coincide with calendar events. Combine this with endpoint detection: a Windows process making Graph API calls while also generating anomalous DNS traffic is a strong indicator.

4. Preserve Evidence Before Acting
Do not delete suspicious calendar entries, revoke app permissions, or disable accounts until you have captured forensic artifacts. Preserve mailbox content, Entra ID sign-in and audit logs, DNS records, proxy logs, and relevant endpoint memory or disk images. The server-side data might be your only route to scoping the intrusion.

5. Harden Without Blocking Graph
It is tempting to block Microsoft Graph outright, but that would cripple most Microsoft 365 tenants. Instead, enforce these long-term measures:
- Require approved client applications with specific permissions; block user consent for high-impact permissions.
- Implement an app lifecycle policy: every application must have an owner, a documented justification, and a review cadence.
- Use anomaly detection policies in Defender for Cloud Apps to alert when an application starts performing unusual actions, such as mass calendar creation or modification.
- Segment high-value mailboxes (executives, finance, legal) with stricter access controls and more aggressive monitoring.

Looking Ahead

HOLLOWGRAPH is a harbinger. The boundary between “inside” and “outside” has evaporated; the modern perimeter is identity and the API consent screen. As organizations grow more dependent on Microsoft 365 and its Graph ecosystem, threat actors will continue to find creative ways to blend their operations into the digital hum of ordinary cloud activity.

Microsoft may respond with enhanced audit capabilities or additional consent prompts for suspicious application behavior, but a patch won’t fix the core problem. The onus is on defenders to treat cloud workloads with the same forensic rigor once reserved for on-premises servers. Your calendar, it turns out, is now a potential battlefield. Start treating it like one.