Hackers Are Turning Microsoft 365 Calendar Invites Into Secret Malware Command Channels

Cybersecuritynews •Guru Baran • July 20, 2026

A stealthy new malware strain called HOLLOWGRAPH that hijacks Microsoft 365 calendars to secretly communicate with hackers, disguising malicious commands as ordinary calendar invites. HOLLOWGRAPH is a .NET-compiled malware component that abuses the Microsoft Graph API through a compromised Microsoft 365 account, turning the mailbox’s calendar into a covert two-way “dead drop” for hackers. The […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

HOLLOWGRAPH Malware Exploits Microsoft 365 Calendars for Espionage Group-IB has identified HOLLOWGRAPH, a sophisticated Windows malware that abuses the Microsoft Graph API to covertly exfiltrate files and receive commands through compromised Microsoft 365 calendar events. The malware operates by creating calendar appointments dated far into the future, specifically May 13, 2050, to avoid detection. It has been linked to the Cavern backdoor framework and is primarily targeting Israeli entities, with 12 confirmed infections. The malware employs DNS tunneling for credential renewal and uses hybrid RSA and AES encryption for secure communications. The attack method is highly targeted, suggesting a well-resourced adversary, potentially linked to Iranian threat actors. The first observed communication occurred on June 3, 2026, with the latest on July 9, 2026. 10 sources 75

Extracted Entities

Hackers Are Turning Microsoft 365 Calendar Invites Into Secret Malware Command Channels

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)