New Malware Turns Microsoft 365 Calendars Into Covert Command-and-Control Channel

A newly uncovered Windows malware implant is abusing Microsoft 365 calendar events to receive instructions and exfiltrate stolen files, allowing its operators to conceal espionage activity inside legitimate Microsoft cloud traffic.

The malware, named HOLLOWGRAPH by Group-IB, transforms a compromised Microsoft 365 mailbox calendar into a two-way command-and-control channel. Attackers place encrypted instructions inside calendar-event attachments, while infected computers return stolen information by creating additional appointments and uploading encrypted files.