HollowGraph Malware Hides Spy Commands Inside Microsoft 365 Calendar Entries
A newly identified piece of malware turns ordinary calendar appointments into a covert messaging system, letting criminals send instructions and steal files without ever touching a suspicious server.
Key points
- Group-IB, a cybersecurity research firm, discovered malware called HollowGraph that uses Microsoft 365 calendar events to pass secret instructions between criminals and infected computers.
- HollowGraph had at least 12 confirmed victims as of the report, with three actively communicating with the attackers' infrastructure at the time of discovery.
- The earliest recorded attack communication was June 3, 2026, suggesting the malware has been active for at least several weeks.
- Researchers link HollowGraph to Lyceum, a hacking group connected to Iran's Ministry of Intelligence and Security, though that attribution is low-confidence.
- The malware stores sensitive configuration details, including encryption keys, in a plain file called logAzure.txt on the infected machine.
When your calendar sends a message, you assume you wrote it. HollowGraph exploits that assumption entirely, and our story yesterday on the same Group-IB report covers the broader Iran-nexus context.
The malware routes all hidden instructions through Microsoft 365 rather than contacting a server criminals openly control, which security tools routinely flag and block. It uses calendar events to do it.
How does the malware actually hide inside a calendar?
The criminals first compromise a Microsoft 365 account, believed to belong to an Israeli organisation, and use it as a secret post box. They create calendar appointments with files attached; those appointments carry encrypted instructions for any computer already running HollowGraph. The infected machine reads the appointments, follows the orders, then creates its own calendar events to send stolen files back.
Every planted appointment is dated 13 May 2050, far enough ahead that the account's real owner won't notice it during normal calendar use.
HollowGraph uses hybrid RSA and AES encryption, two mathematical locking methods widely used in banking and secure messaging, to scramble stolen data before it leaves. It also keeps a backup channel: DNS tunnelling, where small pieces of data hide inside routine address-lookup requests computers make constantly, letting the malware refresh its login credentials without raising alarms.
Group-IB identified 12 victims. The evidence, including an Israeli mailbox used for data extraction and malware samples uploaded from Israel, points toward a deliberate focus on Israeli targets rather than broad, opportunistic attacks.
Researchers provisionally link HollowGraph to Lyceum, also tracked as Hexane and SiameseKitten, assessed to operate under Iran's Ministry of Intelligence and Security. Group-IB is careful: the technical similarities with Lyceum are present but not distinctive enough to support firm attribution. The firm also believes HollowGraph is part of a variant of something called the Cavern framework, connecting it more broadly to the Iran-nexus actor Cavern Manticore.
Should you worry if your organisation uses Microsoft 365?
For defenders, the practical problem is this: no outbound connection to a criminal-controlled server appears in network logs. Teams watching only for that signal will miss HollowGraph entirely. Ask your IT team to audit OAuth application permissions, the settings controlling which apps can read your calendar and email, and flag any unfamiliar apps granted access recently.
