HollowGraph: Malware That Hides Commands in Outlook Calendars

Here is a novel one. Researchers at Group-IB have pulled apart a Windows implant that turns a compromised Microsoft 365 calendar into a two-way command channel. They are calling it HollowGraph, and it is clever enough to be worth a proper look.

The trick is that HollowGraph never reaches out to a suspicious server. It talks to Microsoft Graph, the same API your legitimate mail, calendar and Teams apps use every second of the day. The operator plants a calendar appointment containing instructions. The malware reads it, does the work, then creates a fresh appointment with the stolen files attached and encrypted. To anything watching network traffic, it is just Microsoft 365 doing Microsoft 365 things.

How the channel holds together

The Graph credentials themselves are refreshed over DNS tunnelling, which keeps the operator in control even if a token expires. The payloads riding inside those calendar entries are wrapped in RSA and AES-256-GCM, with separate key pairs for inbound tasking and outbound exfiltration. It is careful work.

Group-IB counted 12 infected systems, with activity running from early June to early July, all pointing at Israeli organisations. The command syntax and tasking format line up with the Cavern backdoor framework, and there are technical echoes of the Iran-linked group Lyceum, though Group-IB stopped short of naming a known actor.

Why this one is awkward to catch

Most detection stacks are built around traffic that looks wrong. Odd domains, strange ports, unexpected outbound connections. HollowGraph sidesteps all of that by living inside a service the business already trusts and already talks to constantly. The bytes on the wire are TLS to Microsoft. There is nothing to block without breaking the business.

The evidence lives elsewhere. Specifically:

• Microsoft Graph API activity logs, where the fingerprints of an automated caller against calendar endpoints will show up.
• Mailbox audit trails, particularly calendar events created, edited or having attachments added by an application principal rather than a human.
• Unexplained appointments. A calendar full of meetings nobody remembers scheduling is exactly the sort of thing nobody looks for, which is exactly why it works.

The wider pattern

HollowGraph is another entry in a growing category of malware that abuses legitimate cloud services for command and control. Attackers have used Dropbox, Google Drive, GitHub, Slack, Telegram, Notion and now Outlook calendars. The appeal is the same every time: the traffic is indistinguishable from normal business activity, and blocking the service outright is not an option.

The defensive shift that follows is not glamorous. It is telemetry, identity signals and audit logs, correlated well enough that a service principal making calendar edits at three in the morning gets noticed. That is a harder muscle to build than buying another appliance, but it is the muscle this kind of intrusion actually strains.

Twelve victims is a small footprint, and the operation looks targeted rather than broad. What matters is the technique. Once someone publishes the playbook, other crews will borrow it, and the calendar will stop being a boring corner of the tenant that nobody watches.