[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fEyw0ataX1b8-bHQmyjWXfJkx-vwCmJJRzrkvu1p1PYE":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":25,"status":26,"created_at":27,"published_at":28,"article":29,"tags":33,"podcasts":52,"controls":53},"51d44b1f-5c74-42de-a804-1c7d5a071e87","hollowgraph-malware-abuses-microsoft-365-calendar-for-stealthy-c2","318967f6-03d2-4f66-9226-b8028411d445","HOLLOWGRAPH Malware Abuses Microsoft 365 Calendar for Stealthy C2","HOLLOWGRAPH represents a sophisticated evolution in attacker tradecraft by hijacking a trusted, everyday productivity tool — Microsoft 365 calendar invites — as a covert command-and-control and data exfiltration channel. Because the malicious traffic blends seamlessly with legitimate enterprise Microsoft 365 activity, traditional perimeter defenses and signature-based detection tools are largely ineffective against it. This technique exploits the implicit trust organizations place in sanctioned SaaS platforms, meaning security teams cannot simply block the service without disrupting business operations. The attack underscores a growing trend of 'living-off-trusted-sites' (LOTS) tactics, where adversaries abuse cloud services rather than custom infrastructure to avoid detection.","**Immediate actions:**\n- Deploy behavioral analytics (UEBA\u002FEDR) capable of detecting anomalous Microsoft 365 API usage patterns, such as automated calendar invite creation or unusual Graph API calls.\n- Audit and restrict which applications and service accounts have permissions to create or access Microsoft 365 calendar entries via the Microsoft Graph API.\n- Hunt for indicators of compromise associated with HOLLOWGRAPH across endpoint telemetry and Microsoft 365 audit logs immediately.\n\n**Configuration & hardening measures:**\n- Apply the principle of least privilege to all Microsoft 365 OAuth app registrations and service principals, revoking unnecessary calendar read\u002Fwrite permissions.\n- Enable Microsoft 365 Advanced Audit logging and route logs to a centralised SIEM to capture Graph API activity and suspicious calendar operations.\n- Configure Microsoft Defender for Cloud Apps (MCAS) policies to alert on atypical calendar data volumes or access patterns from endpoints.\n\n**Long-term improvements:**\n- Conduct regular security awareness training that includes examples of trusted-platform abuse (LOTS attacks) so users and analysts recognise suspicious calendar-based activity.\n- Establish a threat-hunting cadence specifically targeting abuse of SaaS collaboration tools (calendar, email, Teams) as C2 channels.\n- Integrate cloud application activity (Microsoft 365, Google Workspace, etc.) into your incident response playbooks to ensure analysts have defined procedures for SaaS-based malware.",[12,13,14,15,16,17,18,19,20,21,22,23,24],"CIS Control 3: Data Protection","CIS Control 6: Access Control Management","CIS Control 8: Audit Log Management","CIS Control 10: Malware Defenses","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 AU-2: Audit Events","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 SI-4: System Monitoring","NIST CSF DE.CM-1: Network Monitoring","NIST CSF PR.AC-4: Access Permissions & Authorizations","MITRE ATT&CK T1102: Web Service (C2 via trusted external services)","MITRE ATT&CK T1567: Exfiltration Over Web Service","GDPR Article 32: Security of Processing (obligation to detect and respond to breaches)",{},"published","2026-07-20T11:20:38.829313+00:00","2026-07-20T11:20:38.551+00:00",{"id":7,"url":30,"slug":31,"title":32},"https:\u002F\u002Fwww.itsecurityguru.org\u002F2026\u002F07\u002F20\u002Fresearchers-uncover-hollowgraph-malware-that-hides-inside-microsoft-365-calendar-invites\u002F?utm_source=rss&utm_medium=rss&utm_campaign=researchers-uncover-hollowgraph-malware-that-hides-inside-microsoft-365-calendar-invites","researchers-uncover-hollowgraph-malware-that-hides-inside-microsoft-365-calendar-e793f6","Researchers Uncover HOLLOWGRAPH: Malware That Hides Inside Microsoft 365 Calendar Invites",[34,40,46],{"id":35,"name":36,"slug":37,"description":38,"color":39},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":41,"name":42,"slug":43,"description":44,"color":45},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":47,"name":48,"slug":49,"description":50,"color":51},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[54,58,62],{"slug":55,"name":56,"problem":57},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":59,"name":60,"problem":61},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",{"slug":63,"name":64,"problem":65},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes."]