A previously unknown Windows malware strain is exploiting Microsoft 365 calendar functionality to conduct covert espionage operations, according to research published by Group-IB. The malware, named HOLLOWGRAPH, uses calendar invites as a two-way communications channel, allowing attackers to issue commands and steal files while blending into normal enterprise cloud traffic. Group-IB attributes the tool with high confidence to the Cavern backdoor framework, a modular command-and-control toolkit previously associated with Iranian-linked threat activity.
HOLLOWGRAPH operates through a compromised Microsoft 365 account traced to an Israeli organization, using the Microsoft Graph API to create and manipulate calendar events. The malware executes only two commands (get and send) but does so entirely through Microsoft's trusted cloud infrastructure rather than attacker-controlled servers. To avoid detection by the mailbox owner, all malicious calendar events are dated to May 13, 2050, with stolen data or tasking instructions hidden inside file attachments rather than event descriptions.
The malware maintains a separate DNS tunneling channel to refresh its Microsoft Entra ID credentials, performing IPv6 AAAA record lookups against the attacker-controlled domain cloudlanecdn[.]com. Each DNS response smuggles 14 bytes of credential data, which the malware reassembles and stores in a configuration file disguised as logAzure.txt. While this DNS channel transmits data in plaintext, communications through the Graph API are protected with hybrid RSA and AES-256-GCM encryption, using separate key pairs for inbound and outbound traffic.
Group-IB identified at least 12 infected systems, with only three actively communicating with attackers during the analysis period between June 3 and July 9, 2026. The researchers noted technical overlaps with malware previously used by Lyceum, considered a sub-cluster of the Iranian threat actor OilRig, though they characterized this connection as low confidence. The small victim count and Israeli connection suggest a deliberately targeted espionage operation rather than widespread compromise.
Organizations should hunt for indicators including the cloudlanecdn[.]com domain and logAzure.txt configuration file, monitor Microsoft Graph API activity for anomalous calendar operations, and watch for calendar events dated to 2050 with GUID subjects or attachments named File{n}.txt. Defenders should restrict OAuth2 applications using client credentials, enforce Conditional Access policies, implement regular credential rotation, and deploy DNS monitoring capable of detecting tunneling activity such as frequent AAAA queries or high-entropy subdomains.
Source: https://www.itsecurityguru.org/2026/07/20/researchers-uncover-hollowgraph-malware-that-hides-inside-microsoft-365-calendar-invites