Back Feeds.Feedburner

HollowGraph malware uses Microsoft 365 calendar for command and control

Feeds.Feedburner •SC Staff • July 20, 2026

A new malware component called HollowGraph has been identified by Group-IB that leverages the calendar feature within compromised Microsoft 365 mailboxes to act as a command-and-control channel, according to a recent report by Bleeping Computer.

HollowGraph, believed to be part of the Cavern command-and-control framework, targets organizations in Israel for espionage purposes. The malware uses hardcoded credentials to authenticate to the Microsoft Graph API via a compromised Microsoft 365 account. It stores its configuration in a file named logAzure.txt, containing tenant IDs, client secrets, and encryption keys. Commands and exfiltrated data are hidden within files attached to calendar events scheduled for May 13, 2050.

HollowGraph supports GET and SEND commands to retrieve instructions and send stolen data, respectively. Communication is secured using a hybrid encryption scheme combining RSA and AES-256-GCM. An additional channel via DNS tunneling is used to update Microsoft Entra ID details. While not definitively attributed to a known actor, technical similarities suggest a link to Iranian-nexus threat actors. Organizations are advised to monitor Microsoft 365 audit logs for suspicious calendar activity and DNS tunneling patterns.

Source: Bleeping Computer

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

HOLLOWGRAPH Malware Exploits Microsoft 365 Calendars for Espionage Group-IB has identified HOLLOWGRAPH, a sophisticated Windows malware that abuses the Microsoft Graph API to covertly exfiltrate files and receive commands through compromised Microsoft 365 calendar events. The malware operates by creating calendar appointments dated far into the future, specifically May 13, 2050, to avoid detection. It has been linked to the Cavern backdoor framework and is primarily targeting Israeli entities, with 12 confirmed infections. The malware employs DNS tunneling for credential renewal and uses hybrid RSA and AES encryption for secure communications. The attack method is highly targeted, suggesting a well-resourced adversary, potentially linked to Iranian threat actors. The first observed communication occurred on June 3, 2026, with the latest on July 9, 2026. 10 sources 75

Extracted Entities

HollowGraph malware uses Microsoft 365 calendar for command and control

The full story

Extracted Entities

Attack Types (1)

Countries (1)

CWE Weaknesses (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (2)

Tools (1)