HollowGraph Malware Hides C2 and Stolen Files in Microsoft 365 Events Dated 2050
HollowGraph malware uses Microsoft 365 calendar events dated 2050 for C2 and data exfiltration.
A new espionage malware named HollowGraph has been discovered using hijacked Microsoft 365 calendars as a command and control channel. It hides operator instructions and exfiltrates stolen files as attachments within calendar events set for the year 2050, making the traffic appear as legitimate Microsoft 365 activity. The malware also uses DNS to refresh Entra ID login details via an attacker-controlled domain.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonHollowGraph exploits trusted Microsoft 365 infrastructure by embedding command-and-control instructions and stolen file attachments inside calendar events deliberately dated to 2050, effectively camouflaging malicious traffic as routine business activity. This technique is particularly dangerous because most security tools and analysts whitelist Microsoft 365 traffic, leaving the covert channel undetected for extended periods. The malware further abuses DNS and Entra ID (Azure AD) to silently refresh authentication credentials via an attacker-controlled domain, maintaining persistent access. This attack highlights the growing trend of 'living-off-trusted-sites' (LOTS) tactics that bypass perimeter defenses by weaponizing legitimate SaaS platforms.
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- SaaS security posture management (SSPM)
Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — cloudlanecdn[.]com
- malware — HollowGraph
- mitre_attack — T1071.004
- mitre_attack — T1105
- mitre_attack — T1041