HollowGraph Malware Hijacks Microsoft 365 Calendar to Funnel Data to 2050

HollowGraph malware uses Microsoft 365 calendar as C2 channel

The newly uncovered HollowGraph malware has turned a Microsoft 365 calendar into a covert command‑and‑control conduit, slipping operator instructions and exfiltrated documents into events stamped for the year 2050. By embedding malicious payloads as calendar attachments, the implant blends with ordinary Graph API calls, making network monitoring almost blind.

How 2050‑dated events conceal stolen files

Security researchers at Group‑IB observed that the malware leverages the Microsoft Graph endpoint to post events that appear legitimate to administrators.

“We observed the implant leveraging the Graph API to blend malicious traffic with legitimate requests,” a Group‑IB analyst told Reuters.

This technique masks data exfiltration behind calendar invites, with attachments automatically synchronized to victim devices.

Detection remains low, reflected by a ↓ 0% detection rate across major AV platforms. Analysts warn that similar tactics could surface in post‑pandemic threat landscapes, urging enterprises to tighten Graph API audit logs.