HollowGraph Malware Hides Spy Commands Inside Microsoft 365 Calendar Entries
A newly identified piece of malware turns ordinary calendar appointments into a covert messaging system, letting criminals send instructions and steal files without ever touching a suspicious server.
Key points
- Group-IB, a cybersecurity research firm, discovered malware called HollowGraph that uses Microsoft 365 calendar events to pass secret instructions between criminals and infected computers.
- HollowGraph had at least 12 confirmed victims as of the report, with three actively communicating with the attackers' infrastructure at the time of discovery.
- The earliest recorded attack communication was June 3, 2025, suggesting the malware has been active for at least several weeks.
- Researchers believe HollowGraph is linked to Lyceum, a hacking group connected to Iran's Ministry of Intelligence and Security, though they describe that attribution as low-confidence.
- The malware stores sensitive configuration details, including encryption keys, in a plain file called logAzure.txt on the infected machine.
When your calendar sends a message, you assume you wrote it. HollowGraph, a newly discovered piece of malicious software, exploits that assumption entirely.
The malware, named and detailed this week by cybersecurity firm Group-IB, does something unusual. Rather than contacting a server the criminals openly control (which security tools routinely flag and block), it routes all of its hidden instructions through Microsoft 365, the popular office software suite used by millions of businesses worldwide. Specifically, it uses calendar events.
How does the malware actually hide inside a calendar?
The criminals first break into a Microsoft 365 account, believed to belong to an Israeli organisation, and use it as a secret post box. They create calendar appointments with files attached, and those appointments carry encrypted instructions for any computer already infected with HollowGraph. The infected machine reads the appointments, follows the orders, then creates its own calendar events to send stolen files back.
To avoid drawing attention, every planted appointment is dated 13 May 2050, far enough in the future that the account's real owner is unlikely to notice it in their day-to-day calendar view.
The malware uses a combination of RSA and AES encryption (two mathematical locking methods widely used in banking and messaging) to scramble the stolen data before it leaves.
HollowGraph also keeps a backup communication route. It uses a technique called DNS tunnelling, where small pieces of data are hidden inside the routine address-lookup requests computers make millions of times a day, to refresh its login credentials and settings without raising alarms.
Group-IB identified 12 victims. The firm says the evidence points toward a deliberate focus on Israeli targets rather than random, broad attacks.
Researchers provisionally link HollowGraph to Lyceum, also tracked under the names Hexane and SiameseKitten, a hacking group assessed to operate under Iran's Ministry of Intelligence and Security. Group-IB is careful to note the technical similarities are "noteworthy" but "not sufficiently unique" to support firm attribution.
For organisations using Microsoft 365, the practical concern is that no outbound connection to a suspicious criminal server appears in network logs. Defenders looking only for that signal will miss it.
If your organisation uses Microsoft 365, ask your IT team to review OAuth application permissions (the settings that control which apps can read your calendar and email) and look for any unfamiliar apps that were recently granted access.
