New ‘HollowGraph’ Malware Turns Microsoft 365 Calendars Into Stealth Command Channels
A newly documented malware strain dubbed “HollowGraph” hides its command‑and‑control traffic and stolen files inside Microsoft 365 calendar entries dated to the year 2050. By blending into normal Graph API traffic that corporate security tools trust, it raises the stakes for enterprises that rely heavily on cloud productivity suites.
A new piece of malware is exploiting one of the least‑watched corners of corporate cloud life—the far reaches of Microsoft 365 calendars—to quietly move attacker commands and stolen data through networks that think they are looking at routine office traffic.
Security researchers have detailed a threat they call “HollowGraph,” which embeds its command‑and‑control (C2) instructions and exfiltrated files inside Microsoft 365 calendar events dated as far out as the year 2050. The design assumes most users will never scroll that far, and that many security tools will treat calendar synchronization over Microsoft’s Graph API as benign background noise rather than a potential attack channel.
Technically, HollowGraph operates by abusing the same API pathways that legitimate applications use to interact with Microsoft 365 services. Instead of reaching out to an obvious C2 server or using custom protocols that can be flagged by intrusion‑detection systems, infected endpoints talk to what appears to be an ordinary Microsoft cloud service. Commands from the attacker are stored in calendar entries—far into the future to avoid any accidental visibility—while data stolen from the victim is packed into other calendar fields and synced back.
For enterprises, the implications are significant. Many organizations have invested heavily in securing email gateways, web traffic and endpoint behavior, but assume that traffic to and from core productivity platforms like Microsoft 365 is largely trustworthy. HollowGraph targets that assumption, turning a business‑critical service into a blind spot. Because the C2 channel is riding on legitimate Graph traffic, traditional tools that rely on domain or IP reputation may see nothing unusual.
The human impact is indirect but real. Staff whose calendars and documents sit inside Microsoft 365 may have no idea their accounts are being used as vehicles for data theft or persistent access. Incident responders, meanwhile, face the challenge of hunting through calendar metadata and Graph logs for patterns that differ only subtly from normal automation. The longer such malware can operate without detection, the more time attackers have to map internal systems, steal sensitive files and potentially stage follow‑on attacks such as ransomware or business email compromise.
Strategically, HollowGraph is part of a broader trend of adversaries riding on top of trusted cloud platforms and collaboration tools to evade perimeter defenses. It underscores the shift from on‑premise security models to cloud‑centric ones, in which the line between legitimate and malicious traffic runs through shared services owned and operated by third parties. For Microsoft and its enterprise customers, that raises pressure to provide more granular visibility and control over how APIs like Graph are used.
A memorable way to think about the threat is this: attackers no longer need to build their own backdoors when they can hide inside the routine synchronization that keeps everyone’s meetings and documents up to date.
Key signals to watch include whether major organizations report HollowGraph‑style incidents in the wild, how quickly security vendors update detection rules around anomalous Graph calendar activity, and whether Microsoft introduces new telemetry or safeguards for long‑dated calendar events and unusual API usage. Regulators and cyber insurers will also be watching, as any wave of breaches tied to abused cloud services could shift expectations about how companies are meant to secure the tools they now depend on for everyday work.
Sources
- OSINT