HollowGraph Malware Exploits Microsoft 365 Calendars for Espionage

Group-IB researchers have identified a new malware strain known as HOLLOWGRAPH, which specifically targets compromised Microsoft 365 accounts. This malware exploits the Microsoft Graph API to transform the calendar feature into a covert two-way communication channel. Instead of directly contacting attacker infrastructure, HOLLOWGRAPH retrieves encrypted instructions from event attachments using a 'get' command and exfiltrates stolen data by creating new events with encrypted attachments through a 'send' command. Notably, these events are scheduled for May 13, 2050, a date chosen to minimize detection by legitimate users, allowing the malware's traffic to blend seamlessly with standard Graph API calls.

The communications between the malware and its operators utilize a hybrid encryption method, combining RSA and AES-256, with distinct key pairs for both incoming and outgoing data. To maintain access to the Graph API without triggering alerts, the malware refreshes Entra ID credentials through DNS tunneling. Group-IB has linked HOLLOWGRAPH with high confidence to the Cavern modular backdoor framework, based on similarities in command formats and code structure. There are also low-confidence connections to the Iranian-linked Lyceum group, although the primary focus of HOLLOWGRAPH appears to be targeted espionage rather than widespread criminal activity. Evidence suggests that the malware has been observed on at least twelve systems, predominantly in Israel, with active command and control traffic detected on approximately three systems between early June and mid-July 2026.

Importantly, HOLLOWGRAPH does not exploit any vulnerabilities within Microsoft 365 or the Graph API; instead, it operates through trusted cloud services and a pre-compromised mailbox belonging to an Israeli organization. As a result, detection of this malware relies on monitoring identity and application permissions, identifying anomalous calendar events scheduled far into the future, and recognizing unusual DNS tunneling activities, rather than traditional network indicators or software patches. Organizations are advised to closely examine Graph API usage patterns and calendar activities to detect these subtle signs of abuse.