[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBW1ID9vb22w2tEwIPASQOGuOjjFpvuNwilN3yzW5NxA":3},{"article":4,"iocs":40,"watch_terms":41,"solutions":42,"lesson":129},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":27},"318967f6-03d2-4f66-9226-b8028411d445","Researchers Uncover HOLLOWGRAPH: Malware That Hides Inside Microsoft 365 Calendar Invites","researchers-uncover-hollowgraph-malware-that-hides-inside-microsoft-365-calendar-e793f6","A previously undocumented strain of Windows malware is using Microsoft 365 calendar invites as a covert communications channel, allowing attackers to issue commands and exfiltrate stolen files from victim networks while hiding in plain sight among ordinary enterprise traffic, according to new research from the threat intelligence firm Group-IB. The malware, dubbed HOLLOWGRAPH, was detailed […] The post Researchers Uncover HOLLOWGRAPH: Malware That Hides Inside Microsoft 365 Calendar Invites appeared first on IT Security Guru.","Researchers have discovered a new Windows malware strain named HOLLOWGRAPH that leverages Microsoft 365 calendar invites as a covert channel for command and control (C2) and data exfiltration. This sophisticated technique allows attackers to blend malicious communications with legitimate enterprise traffic, making detection significantly more challenging. Group-IB's research highlights the novel use of a common productivity tool for malicious purposes.","New HOLLOWGRAPH malware uses Microsoft 365 calendar invites for C2 and data exfiltration.","https:\u002F\u002Fwww.itsecurityguru.org\u002F2026\u002F07\u002F20\u002Fresearchers-uncover-hollowgraph-malware-that-hides-inside-microsoft-365-calendar-invites\u002F?utm_source=rss&utm_medium=rss&utm_campaign=researchers-uncover-hollowgraph-malware-that-hides-inside-microsoft-365-calendar-invites",null,"2026-07-20T10:32:41+00:00","2026-07-20T11:03:00.976427+00:00",8,[17,20],{"name":18,"type":19},"Microsoft 365","product",{"name":21,"type":22},"Group-IB","vendor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":23,"icon":12,"name":25,"slug":26},"Malware","malware",[28,33,35],{"category":29},{"id":30,"icon":12,"name":31,"slug":32},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":34},{"id":23,"icon":12,"name":25,"slug":26},{"category":36},{"id":37,"icon":12,"name":38,"slug":39},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,18],{"controls":43,"vendors":128},[44,73,102],{"slug":45,"name":46,"problem":47,"products":48},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[49,57,65],{"vendor_slug":50,"vendor_name":51,"vendor_logo":52,"product_slug":53,"product_name":54,"url":55,"description":56},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":74,"name":75,"problem":76,"products":77},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[78,86,94],{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"slug":103,"name":104,"problem":105,"products":106},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[107,115,120],{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":116,"product_name":117,"url":118,"description":119},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",[],{"slug":130,"title":131,"body":132,"framework_refs":133,"framework_notes":147},"hollowgraph-malware-abuses-microsoft-365-calendar-for-stealthy-c2","HOLLOWGRAPH Malware Abuses Microsoft 365 Calendar for Stealthy C2","HOLLOWGRAPH represents a sophisticated evolution in attacker tradecraft by hijacking a trusted, everyday productivity tool — Microsoft 365 calendar invites — as a covert command-and-control and data exfiltration channel. Because the malicious traffic blends seamlessly with legitimate enterprise Microsoft 365 activity, traditional perimeter defenses and signature-based detection tools are largely ineffective against it. This technique exploits the implicit trust organizations place in sanctioned SaaS platforms, meaning security teams cannot simply block the service without disrupting business operations. The attack underscores a growing trend of 'living-off-trusted-sites' (LOTS) tactics, where adversaries abuse cloud services rather than custom infrastructure to avoid detection.",[134,135,136,137,138,139,140,141,142,143,144,145,146],"CIS Control 3: Data Protection","CIS Control 6: Access Control Management","CIS Control 8: Audit Log Management","CIS Control 10: Malware Defenses","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 AU-2: Audit Events","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 SI-4: System Monitoring","NIST CSF DE.CM-1: Network Monitoring","NIST CSF PR.AC-4: Access Permissions & Authorizations","MITRE ATT&CK T1102: Web Service (C2 via trusted external services)","MITRE ATT&CK T1567: Exfiltration Over Web Service","GDPR Article 32: Security of Processing (obligation to detect and respond to breaches)",{}]