HollowGraph Spies Hide Their Orders in Fake Calendar Events Dated 2050

Key points

• Group-IB has named a new espionage tool HollowGraph that uses hijacked Microsoft 365 calendars as its control channel.
• The malware plants operator instructions and stolen files inside calendar events dated to the year 2050 to keep them out of sight.
• All traffic runs through the legitimate Microsoft Graph API, so the activity blends in with normal Microsoft 365 use.
• The technique lets attackers avoid setting up suspicious servers of their own, since everything stays inside Microsoft's cloud.

Spies have found a quiet new place to hide their paperwork: your calendar.

Researchers at Group-IB say they've uncovered an espionage tool they're calling HollowGraph. It uses a victim's own Microsoft 365 calendar as the secret channel between the attackers and the infected machine.

Once HollowGraph is on a computer, it logs in to the victim's Microsoft 365 account and creates calendar events dated to the year 2050. Nobody scrolls that far ahead. Those events sit invisible in day-to-day use, holding the attackers' instructions in the notes and description fields. When the malware wants to steal a document, it doesn't email it out or upload it to some unfamiliar server. It attaches the file to one of those 2050 calendar entries. The attackers, sharing access to the same mailbox, simply open the meeting and collect the file.

Think of it as a dead drop: a park bench where two spies leave notes for each other, except the bench is a meeting invite nobody will ever click.

How does this slip past security tools?

It slips past because, from the network's point of view, nothing unusual is happening.

Every action HollowGraph takes runs through the Microsoft Graph API, the official doorway apps use to read and write Microsoft 365 data such as mail and calendars. Legitimate business software uses Graph constantly. A calendar sync from an infected laptop looks identical to a calendar sync from a healthy one.

That's the whole point. Attackers don't need to run their own command server, the machine that normally sends orders to malware and receives stolen data. Setting one up is among the easiest ways for defenders to spot an intrusion. Here, there's no strange server to find. There's only Microsoft, talking to Microsoft.

Criminals have hidden traffic inside trusted cloud services before. Using calendar events as the actual mailbox is what's new, and it's a detail worth watching: we first covered Group-IB's research on ClickLock, the Mac stealer that freezes screens until victims type their passwords, in July, and that campaign also showed how social engineering and cloud-native plumbing are increasingly doing the work that custom infrastructure used to do.

Should you worry?

For most people, honestly, not much changes at the keyboard level.

HollowGraph looks like a targeted espionage tool rather than a mass-market scam. It still needs to reach a machine first, through a booby-trapped attachment, a stolen password or a phishing link. So the usual defences apply: treat unexpected attachments with suspicion and turn on multi-factor authentication, the extra code or app prompt layered on top of your password, for Microsoft accounts.

For IT teams, the implication is sharper. Normal-looking Graph API traffic is no longer proof that nothing is wrong. Hunting for HollowGraph-style behaviour means examining what accounts are actually doing inside Microsoft 365, not just whether traffic is heading to a Microsoft domain. Calendar events set decades in the future are a reasonable place to start looking.

The broader judgement here: this isn't a novel attack category so much as a very tidy refinement of living-off-trusted-cloud, a technique that keeps getting quieter and harder to distinguish from legitimate use. The calendar angle is clever, but the real story is how little custom infrastructure modern espionage now needs.