HollowGraph: malware hides its C2 and stolen data in Microsoft 365 events dated 2050

Hijacking the agenda as a clandestine mailbox: HollowGraph uses Microsoft 365 events - backdated by twenty-four years - to exfiltrate files and receive its orders without raising any alerts.

The facts

The Group-IB threat researcher, relayed by The Hacker News on July 20, 2026, documents a malware family named HollowGraph, whose particularity is to use Microsoft 365 calendar events as a command and control channel and as an exfiltration vault. The created events have very distant dates - the article cites the year 2050 - to not appear in usual calendar views (today, this week, this month).

It is Group-IB that named the strain and published the technical description of the implant; The Hacker News ensures its dissemination.

Technically, HollowGraph relies on the Microsoft Graph API: it creates, reads, and modifies events of a compromised account. The C2 instructions are written in the description or attachment fields of the events; the stolen data is re-encoded and deposited in turn. To a network gateway, it is only legitimate HTTPS traffic to graph.microsoft.com.

Analysis

This technique is not fundamentally new - other families have abused OneDrive, Teams, SharePoint, or Outlook - but the calendar has been under-monitored until now. Two reasons for this:

• Events trigger almost no DLP (data loss) alerts because they are, by nature, free fields.
• Distant dates make them invisible in the default UI views of Outlook and Teams, without being invisible to Graph.

It is the double signature that should be remembered: Graph API + abnormal time horizon.

Who is affected

Any Microsoft 365 organization where a user account, a service account, or a registered application (App Registration) is compromised. The switch to HollowGraph does not require admin rights: standard calendar permissions are sufficient.

What to do now

1. Hunt in Graph audit logs: queries of type Event.ReadWrite on events where the start.dateTime exceeds 2035. The threshold is arbitrary, adapt it to your business horizon.
2. DLP rule: inspect event descriptions for encoded payloads (long base64, binary chunks, magic bytes).
3. App Consent Governance: review third-party applications that have requested Calendars.ReadWrite; any app with this permission that is little used deserves a consent removal.
4. UEBA detection: an account that suddenly creates dozens of events per day, or that writes to the year 2050, is a signal.

Key takeaways

HollowGraph illustrates the rule that has been repeated for years: C2 hides where traffic is already legitimate. After GitHub, Discord, Telegram, and Slack, the M365 calendar becomes another brick in the attackers' arsenal. Our detection rule queue must follow.