HOLLOWGRAPH malware hides in Microsoft 365 calendars

Published July 17, 2026

HOLLOWGRAPH is malware that hides its remote control channel inside a hacked Microsoft 365 email account's calendar. Attackers plant instructions as calendar events and use the same mailbox to steal files back out, so the traffic looks like normal Microsoft 365 activity.

Report priority
Medium
Targets
Microsoft 365

How it works

Attackers who already control a Microsoft 365 account use its mailbox calendar as a hidden two-way message drop, writing fake calendar events dated far in the future so the malware on the victim's system can read commands and upload stolen files through Microsoft's own cloud, and a separate DNS lookup channel refreshes the malware's stolen login credentials.

What to do

Organizations should check Microsoft 365 audit logs for mailbox calendar events dated 13 May 2050 or file attachments named File{n}.txt, and watch for unusual outbound DNS queries using IPv6 AAAA records.

Organizations should reset credentials and review Entra ID (Azure AD) sign-in activity for any Microsoft 365 mailbox, enable multi-factor authentication, and follow Group-IB's incident guidance if the calendar dead-drop pattern is found.

Technical details

Attackers get control of a Microsoft 365 account belonging to an Israeli organization. They add calendar events dated 13 May 2050 to that mailbox, each carrying a hidden command and a file attachment named in a File{n}.txt pattern. The HOLLOWGRAPH malware on the infected computer checks that calendar, decrypts the event to get its task, then creates its own future-dated event to send a stolen file back out through the same mailbox.

HOLLOWGRAPH is a.NET NativeAOT DLL that Group-IB Threat Intelligence links with high confidence to the Cavern backdoor framework, with a low-confidence possible tie to Lyceum, an Iranian-nexus group and OilRig sub-group. It supports only two commands, get and send, both executed through the Microsoft Graph API against a compromised mailbox's calendar, using separate RSA-OAEP key pairs per direction plus AES-256-GCM for payload encryption. A second, unencrypted channel refreshes Microsoft Entra ID (Azure AD) credentials via DNS tunneling over IPv6 AAAA records, storing values in a file disguised as a log. Group-IB observed 12 infected systems, about three actively communicating, with contact between 3 June 2026 and 9 July 2026, indicating targeted espionage against Israeli entities rather than broad opportunistic activity.

References

View Original Source