HollowGraph Spies Hide Their Orders in Fake Calendar Events Dated 2050

Key points

• Group-IB has named a new espionage tool HollowGraph that uses hijacked Microsoft 365 calendars as its control channel.
• The malware plants operator instructions and stolen files inside calendar events dated to the year 2050 to keep them out of sight.
• All traffic runs through the legitimate Microsoft Graph API, so the activity blends in with normal Microsoft 365 use.
• The technique lets attackers avoid setting up suspicious servers of their own, since everything stays inside Microsoft's cloud.

Spies have found a quiet new place to hide their paperwork: your calendar.

Researchers at Group-IB say they have uncovered an espionage tool they are calling HollowGraph. It uses a victim's own Microsoft 365 calendar as the secret channel between the attackers and the infected machine.

The trick is almost mundane, which is part of what makes it clever.

Once HollowGraph is on a computer, it logs in to the victim's Microsoft 365 account and creates calendar events dated far in the future, specifically the year 2050. Nobody scrolls that far ahead. The events sit there, invisible in day-to-day use, holding the attackers' instructions in the notes and description fields.

When the malware wants to steal a document, it does not email it out or upload it to some odd server on the internet. It attaches the file to one of those 2050 calendar entries. The attackers, who share access to the same mailbox, simply open the meeting and take the file.

Think of it as a dead drop. A park bench where two spies leave notes for each other, except the bench is a meeting invite nobody will ever click.

How does this slip past security tools?

It slips past because, from the network's point of view, nothing unusual is happening.

Every action HollowGraph takes runs through the Microsoft Graph API, which is the official doorway apps use to read and write Microsoft 365 data such as mail, files and calendars. Legitimate business software uses Graph all day long. A calendar sync from an infected laptop looks identical to a calendar sync from a healthy one.

That is the whole point. The attackers do not need to run their own command server, which is the machine that normally sends orders to malware and receives stolen data. Setting up such a server is one of the easiest ways for defenders to spot an intrusion. Here, there is no strange server to spot. There is only Microsoft, talking to Microsoft.

It is a familiar pattern with a new twist. Criminals have long hidden their traffic inside trusted cloud services like Dropbox, Google Drive and Telegram. Using calendar events as the mailbox is the fresh wrinkle.

What should ordinary users take from this?

For most people, the honest answer is: not much you can do at your keyboard.

HollowGraph, as reported by Group-IB and picked up by The Hacker News, looks like a targeted espionage tool rather than a mass-market scam. It still needs to get onto a machine first, usually through the old routes: a booby-trapped attachment, a stolen password, a dodgy login link.

So the usual advice holds. Be wary of unexpected attachments. Turn on multi-factor authentication, which is the extra code or app prompt on top of your password, for your work and personal Microsoft accounts. If your employer offers a password manager and a way to report suspicious emails, use both.

For IT teams, the takeaway is sharper. Normal-looking Graph API activity is no longer proof that nothing is wrong. Anyone hunting for HollowGraph-style behaviour will need to look at what accounts are actually doing inside Microsoft 365, not just whether the traffic goes to a Microsoft domain. Calendar events set decades in the future would be a reasonable place to start.