Researchers Uncover HOLLOWGRAPH: Malware That Hides Inside Microsoft 365 Calendar Invites
New HOLLOWGRAPH malware uses Microsoft 365 calendar invites for C2 and data exfiltration.
Researchers have discovered a new Windows malware strain named HOLLOWGRAPH that leverages Microsoft 365 calendar invites as a covert channel for command and control (C2) and data exfiltration. This sophisticated technique allows attackers to blend malicious communications with legitimate enterprise traffic, making detection significantly more challenging. Group-IB's research highlights the novel use of a common productivity tool for malicious purposes.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Group-IB?
Get an email when a new story names Group-IB, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonHOLLOWGRAPH represents a sophisticated evolution in attacker tradecraft by hijacking a trusted, everyday productivity tool — Microsoft 365 calendar invites — as a covert command-and-control and data exfiltration channel. Because the malicious traffic blends seamlessly with legitimate enterprise Microsoft 365 activity, traditional perimeter defenses and signature-based detection tools are largely ineffective against it. This technique exploits the implicit trust organizations place in sanctioned SaaS platforms, meaning security teams cannot simply block the service without disrupting business operations. The attack underscores a growing trend of 'living-off-trusted-sites' (LOTS) tactics, where adversaries abuse cloud services rather than custom infrastructure to avoid detection.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.