How HollowGraph Malware Hijacks Microsoft 365 Calendars Dated 2050 to Steal Data

Emily Davis · 2026-07-20

Imagine a thief using your own calendar to plan his next move and hide the loot. That's exactly what a newly discovered espionage implant called HollowGraph does. It hijacks Microsoft 365 calendars, planting operator instructions and smuggling out stolen files as attachments on calendar events dated to the year 2050. Group-IB, the cybersecurity firm that named the malware HollowGraph, says the approach moves tasking and stolen data through legitimate Microsoft Graph API traffic. This means the activity looks like normal, everyday calendar syncing, making it incredibly hard to detect. ### How the Attack Works The malware takes advantage of the Microsoft Graph API, which is a gateway for apps to interact with Microsoft 365 services like calendars, emails, and files. Here's a breakdown of the attack flow: - **Initial Compromise**: HollowGraph gets onto a system through a phishing email or a malicious download. - **Calendar Hijacking**: Once inside, it connects to the victim's Microsoft 365 account and creates calendar events. These events are dated far in the future, like 2050, to avoid raising suspicion during routine checks. - **Command and Control (C2)**: The malware reads instructions from these events. The attacker writes commands in the event details, and HollowGraph executes them on the infected machine. - **Data Exfiltration**: Stolen files are attached to these calendar events as attachments. Since the events are synced through Microsoft's servers, the data is sent out without triggering traditional security alerts. ### Why This Is So Dangerous Traditional security tools often focus on detecting unusual network traffic or malware signatures. But HollowGraph blends in by using a legitimate service. Here's why it's a game-changer: - **It Looks Normal**: Microsoft Graph API traffic is common in most organizations. Security teams rarely scrutinize calendar syncs. - **Future Dates Hide Activity**: Calendar events dated 2050 won't show up in daily or weekly views, so they fly under the radar. - **No Custom Malware Signatures**: The malware uses standard API calls, so it doesn't leave the usual fingerprints. ### What You Can Do to Protect Yourself This isn't just a threat for big corporations. Anyone using Microsoft 365 could be at risk. Here are some practical steps: - **Monitor API Activity**: Set up alerts for unusual or excessive Graph API calls, especially those creating calendar events. - **Review Calendar Events**: Periodically check for events with odd dates or no attendees. Look for attachments you didn't create. - **Use Strong Access Controls**: Limit which apps can access your Microsoft 365 data. Enable multi-factor authentication to make it harder for attackers to hijack accounts. - **Educate Your Team**: Train employees to spot phishing attempts that could lead to initial compromise. A little awareness goes a long way. > "HollowGraph is a reminder that attackers are getting creative with the tools we use every day. Your calendar isn't just a schedule—it could be a backdoor." — Group-IB Research ### The Bigger Picture HollowGraph is part of a growing trend where malware uses legitimate services to hide. We've seen similar tactics with Google Drive, Dropbox, and even social media platforms. The key takeaway? Security isn't just about blocking bad stuff—it's about understanding how normal tools can be twisted for malicious purposes. Staying ahead means staying curious. Ask questions about what's normal in your environment. If something feels off, dig deeper. That calendar event in 2050? It might be more than a typo.