Microsoft 365 Calendar Attack: How HOLLOWGRAPH Hid Malware Commands

A newly reported Microsoft 365 calendar attack demonstrates how cybercriminals and espionage groups can misuse trusted cloud services to disguise malicious activity.

Cybersecurity researchers at Group-IB reported finding Windows malware known as HOLLOWGRAPH. Rather than communicating with an obviously malicious internet server, the malware reportedly used Microsoft Graph and a compromised Microsoft 365 calendar to obtain instructions and return stolen information.

Commands were hidden in calendar events dated far into the future, while stolen files could be attached to those events. The malware also reportedly used DNS tunnelling as part of its process for refreshing the credentials used to access the cloud account.

The discovery does not mean that ordinary Microsoft 365 calendar appointments are inherently unsafe. It shows how malware can abuse legitimate cloud services after a computer and its associated credentials have already been compromised.

For businesses, the important lesson is that securing Microsoft 365 requires more than filtering suspicious email. Organisations must also protect identities, restrict application permissions, monitor cloud activity and detect unusual behaviour on endpoints.

What Is the HOLLOWGRAPH Microsoft 365 Calendar Attack?

HOLLOWGRAPH is the name given to a Windows malware implant discovered by Group-IB researchers.

The malware reportedly used a compromised Microsoft 365 account as part of its command-and-control system.

Command and control, usually shortened to C2, is the communication channel that allows an attacker to control malware after it has infected a computer.

A C2 channel can be used to:

• Issue instructions to the infected computer.
• Download additional malicious components.
• Search for files.
• Capture system information.
• Run commands.
• Upload stolen information.
• Change the malware’s configuration.
• Maintain access to the compromised environment.

Traditional malware might connect to an internet domain or server operated by the attacker. Security products can block those communications when the destination is known to be malicious.

HOLLOWGRAPH took a different approach. It reportedly communicated through Microsoft’s legitimate cloud infrastructure using Microsoft Graph.

Microsoft Graph is an application programming interface used by legitimate software to work with Microsoft 365 services, including:

• Outlook.
• Calendars.
• Email.
• OneDrive.
• SharePoint.
• Teams.
• Users and groups.
• Microsoft Entra ID.

Because Microsoft Graph is routinely used by normal business applications, malicious activity conducted through it can blend into legitimate cloud traffic.

How Did HOLLOWGRAPH Use Microsoft 365 Calendars?

According to Group-IB’s analysis, the malware could connect to a Microsoft 365 account and inspect specially prepared calendar events.

The attacker could place instructions inside an event, and the malware would retrieve and process those instructions.

Reported techniques included:

• Using calendar events dated in 2050.
• Reading attacker instructions from event content.
• Uploading stolen data as calendar-event attachments.
• Communicating through the Microsoft Graph API.
• Using legitimate Microsoft cloud infrastructure.
• Refreshing credentials through DNS-based communications.

Using events dated decades into the future made them less likely to appear in the normal working calendar view of the compromised account.

The activity could therefore remain hidden from an employee who only checks their current daily or weekly calendar.

Researchers described the approach as a covert two-way communication channel. The attacker could issue commands through the cloud calendar, while the malware could return information through the same Microsoft 365 environment.

Does This Mean Calendar Invitations Can Infect a Computer?

An ordinary calendar invitation does not automatically infect a computer with HOLLOWGRAPH.

The reported attack is not simply a malicious appointment that executes malware as soon as someone opens their calendar.

For the technique to work, the attacker generally requires several components:

• Malware already running on a Windows computer.
• Access to valid Microsoft 365 credentials or tokens.
• Permission to access the relevant calendar.
• The ability to communicate with Microsoft Graph.
• A method for issuing commands and retrieving stolen information.

The calendar is being used as a hidden communication mechanism after compromise, not necessarily as the original infection method.

Employees should still be cautious with unexpected meeting invitations, particularly those containing links or attachments. However, deleting suspicious invitations alone would not address a computer already infected with malware.

Why Would Attackers Use Microsoft 365 for Command and Control?

Attackers need malware communications to remain available and unnoticed.

Operating an independent malicious server creates several disadvantages for an attacker:

• The domain can be identified and blocked.
• The hosting provider can remove the server.
• The IP address can be added to security blocklists.
• Network monitoring tools can flag the unusual destination.
• Investigators can analyse the infrastructure.
• The server may reveal connections between different victims.

Using a legitimate cloud platform makes detection more difficult.

Trusted Network Traffic

Most businesses permit access to Microsoft 365. Blocking all communication with Microsoft Graph would disrupt legitimate applications and everyday work.

Valid HTTPS Encryption

Traffic to Microsoft cloud services is encrypted. Traditional network devices may see a secure connection to a trusted Microsoft destination without understanding the full application activity inside it.

Reliable Infrastructure

Microsoft cloud services are designed to be highly available. Attackers benefit from an infrastructure that is unlikely to disappear unexpectedly.

Normal Business Behaviour

A computer accessing Microsoft 365, Outlook or a calendar does not automatically appear suspicious.

Reduced Dependence on Attacker Domains

The attacker does not need every infected device to contact a clearly malicious domain.

This technique is part of a wider cybersecurity challenge sometimes described as living off trusted services. Attackers increasingly attempt to use legitimate cloud platforms, remote-management products and collaboration tools to disguise their activity.

Was Microsoft 365 Hacked?

The HOLLOWGRAPH report does not mean that attackers broke into Microsoft’s underlying cloud infrastructure or gained unrestricted access to every Microsoft 365 tenant.

The reported technique involved misuse of legitimate Microsoft 365 functionality through compromised credentials and malware.

This distinction matters.

There is a significant difference between:

• A vulnerability that compromises Microsoft 365 globally.
• An attacker stealing one organisation’s credentials.
• Malware using authorised cloud functions in an unauthorised way.
• A badly configured application receiving excessive permissions.
• A user approving a malicious OAuth application.

In the HOLLOWGRAPH case, Microsoft 365 appears to have been used as part of the attacker’s infrastructure rather than being universally breached.

Businesses should therefore avoid two incorrect conclusions:

1. Microsoft 365 calendars are now unsafe and must be disabled.
2. Microsoft is responsible for detecting every malicious action performed using valid customer credentials.

Cloud security is a shared responsibility. Microsoft protects the underlying service, but each organisation must secure its identities, devices, permissions and administrative settings.

What Is Microsoft Graph?

Microsoft Graph provides a standard way for applications to interact with Microsoft cloud information.

A legitimate business application might use Microsoft Graph to:

• Create calendar appointments.
• Read a user’s availability.
• Upload documents to OneDrive.
• Send an email.
• Create a Teams meeting.
• Read directory information.
• Automate onboarding tasks.
• Produce management reports.

Applications must normally authenticate and obtain permission before accessing this information.

Permissions can be delegated, meaning the application acts on behalf of a signed-in user, or application-based, allowing the software to operate independently within approved limits.

Graph itself is not malicious. It is a powerful business tool.

The danger arises when:

• Credentials are stolen.
• Authentication tokens are captured.
• An attacker registers a malicious application.
• A user approves excessive permissions.
• An administrator grants inappropriate tenant-wide consent.
• Malware accesses stored credentials on an infected device.
• Old application permissions are never reviewed or removed.

Why Multifactor Authentication May Not Be Enough

Multifactor authentication remains one of the most effective protections against account takeover, but it does not eliminate every threat.

An attacker may bypass or undermine MFA by:

• Stealing an active session token.
• Tricking a user into approving a fraudulent login.
• Using adversary-in-the-middle phishing.
• Compromising a trusted computer after the user has signed in.
• Abusing an authorised OAuth application.
• Stealing locally stored application credentials.
• Using a legacy authentication method.
• Taking control of an already authenticated browser session.

This means businesses should implement MFA but also add controls around it.

Useful protections include:

• Phishing-resistant authentication.
• Microsoft Entra Conditional Access.
• Device compliance requirements.
• Sign-in risk policies.
• Session controls.
• Token protection where supported.
• Restricted administrator access.
• Regular permission reviews.
• Endpoint detection and response.

Could Normal Antivirus Detect HOLLOWGRAPH?

Traditional antivirus may detect a known malware file or suspicious process, but cloud-based command-and-control techniques can be challenging to identify.

The malicious traffic may appear to be:

• A legitimate connection to Microsoft.
• Normal encrypted HTTPS traffic.
• An authorised application calling Microsoft Graph.
• A calendar operation performed with valid credentials.

This is why modern cybersecurity relies on multiple layers.

Endpoint Detection and Response

EDR products monitor process behaviour, command execution, file access, credential activity and network connections on the computer.

They may identify that an unusual process is accessing credentials, collecting documents or repeatedly communicating with Microsoft Graph.

Microsoft 365 Audit Logging

Microsoft 365 audit data can reveal unusual calendar operations, application activity and access patterns.

Entra ID Sign-In Monitoring

Administrators can investigate unfamiliar locations, impossible travel, suspicious devices, unusual applications and abnormal token usage.

Application Permission Monitoring

A review can identify applications with permissions that are no longer required or are broader than expected.

DNS Monitoring

HOLLOWGRAPH reportedly used DNS tunnelling in part of its operation. Monitoring unusually long, encoded or repetitive DNS queries may help identify that type of behaviour.

Behavioural Analysis

Security systems can identify deviations from normal user and device activity even when the destination itself is legitimate.

Warning Signs Businesses Should Investigate

There may be no single visible indication of a Microsoft 365 calendar attack, but the following signs merit investigation:

• Calendar events created far into the future.
• Unfamiliar calendar events with attachments.
• Calendar activity from a user who is not working.
• Unusual access through Microsoft Graph.
• Unknown enterprise applications.
• Newly granted OAuth permissions.
• Sign-ins from unfamiliar devices or countries.
• Repeated token refresh activity.
• Suspicious PowerShell or command-line processes.
• Unexpected DNS traffic.
• Endpoint protection alerts.
• OneDrive, Outlook or Teams activity inconsistent with the user’s role.
• A Microsoft 365 account accessing unusual quantities of data.
• Calendar events that repeatedly appear, change or disappear.
• A normal user account performing automated high-volume actions.

None of these signs proves that HOLLOWGRAPH is present. They provide starting points for investigation.

How Businesses Can Reduce the Risk

No individual control can prevent every cloud-based attack. A layered security approach provides the strongest defence.

1. Protect Every Microsoft 365 Account with MFA

MFA should be enabled across all users, particularly administrators, finance staff and senior managers.

Avoid relying solely on SMS where stronger methods are available.

2. Use Conditional Access

Microsoft Entra Conditional Access can restrict access based on:

• User risk.
• Sign-in risk.
• Device condition.
• Geographic location.
• Application.
• Authentication strength.
• Network.
• User role.

A business might require compliant devices for access to sensitive cloud information or block sign-ins from countries where it does not operate.

3. Review OAuth and Enterprise Applications

Identify every application with access to Microsoft 365.

For each application, establish:

• Who approved it?
• What business purpose does it serve?
• Which users can access it?
• What information can it read?
• Can it modify or delete data?
• Does it have tenant-wide permission?
• Is the supplier still trusted?
• Is the application still used?

Remove permissions that are no longer required.

4. Restrict User Consent

Employees should not automatically be allowed to approve any application that requests access to company data.

Use an approval workflow for applications requiring sensitive permissions.

5. Secure Administrator Accounts

Administrators should use separate accounts for administration and ordinary email.

Privileged accounts should not be used for routine web browsing or everyday office work.

6. Deploy Endpoint Detection and Response

Modern endpoint protection can identify behaviour that signature-based antivirus may miss.

This is especially important when malware communicates with legitimate cloud services.

7. Monitor Microsoft 365 Activity

Review audit logs, sign-in records, risky-user alerts and application activity.

Automated alerting is preferable to waiting for an employee to notice something unusual.

8. Maintain Supported Devices

Apply Windows, browser, Office and third-party software updates promptly.

Unsupported operating systems should be replaced, upgraded or isolated.

9. Control PowerShell and Scripting

Many legitimate administrators use PowerShell, but it is also commonly abused by attackers.

Businesses should log script activity and restrict powerful scripting functions where appropriate.

10. Back Up Microsoft 365 Data

Maintain a separate backup of Exchange Online, OneDrive, SharePoint and Teams information.

A cloud account compromise can lead to deletion, encryption or manipulation of business data.

11. Train Employees

Cybersecurity awareness should cover:

• Unexpected MFA prompts.
• Fake Microsoft sign-in pages.
• Malicious application-consent requests.
• Suspicious Teams invitations.
• Unusual calendar requests.
• Requests to install software.
• Unexpected remote-support calls.

12. Create an Incident Response Plan

Businesses should know who will:

• Disable a compromised account.
• Revoke active sessions.
• Reset credentials.
• remove malicious applications.
• Isolate an infected computer.
• preserve evidence.
• Restore affected data.
• Notify management.
• assess regulatory reporting requirements.

What to Do If You Suspect a Microsoft 365 Account Is Compromised

A suspected compromise should be handled methodically.

Isolate the Computer

Disconnect a potentially infected endpoint from the network while avoiding unnecessary shutdown if forensic investigation may be required.

Disable or Restrict the Account

Prevent further access while the incident is investigated.

Revoke Active Sessions

Changing a password alone may not invalidate every existing cloud session or token.

Reset Authentication Methods

Check whether the attacker added a new phone number, authenticator, email address or passkey.

Review Sign-In Logs

Look for unfamiliar IP addresses, devices, countries, applications and authentication methods.

Review Application Consent

Remove suspicious OAuth applications and permissions.

Examine Mailbox Rules and Forwarding

Attackers frequently create rules that hide, delete or forward email.

Review Calendar and Graph Activity

Check for unusual events, future-dated entries, attachments and automated operations.

Scan and Investigate the Endpoint

Use appropriate security tools to identify malware, credential theft and persistence mechanisms.

Review Other Accounts

A compromised administrator or shared device may have exposed additional users.

Restore Data Carefully

Do not restore files or systems until the cause of the incident has been understood and contained.

The Wider Lesson for Cloud Security

HOLLOWGRAPH is important not because every business is likely to encounter this exact malware, but because it demonstrates a broader change in attacker behaviour.

Security teams have traditionally focused on obviously malicious destinations. Modern attackers increasingly attempt to hide inside:

• Microsoft 365.
• Google cloud services.
• Collaboration platforms.
• Content delivery networks.
• Public code repositories.
• Remote administration products.
• Cloud-storage services.
• Trusted software suppliers.

Blocking a suspicious domain remains useful, but it is no longer sufficient.

Businesses must understand:

• Who is signing in.
• Which device they are using.
• Which application is requesting access.
• What permissions it has.
• Whether the behaviour is normal.
• What information is leaving the organisation.
• Whether the endpoint itself is trustworthy.

Identity has become one of the most important security boundaries in a modern cloud environment.

How Fox Technologies Can Help

Fox Technologies helps UK businesses secure Microsoft 365, Microsoft Entra ID, endpoints and cloud data.

Our Microsoft 365 security services can include:

• Multifactor authentication deployment.
• Microsoft Entra Conditional Access.
• User and administrator account reviews.
• Enterprise application audits.
• OAuth permission reviews.
• Microsoft 365 security assessments.
• Endpoint protection and EDR.
• Email security.
• Microsoft 365 backup.
• Security monitoring.
• Cybersecurity awareness training.
• Incident-response assistance.
• Cyber Essentials preparation.
• Device and operating-system audits.

Visit Fox Technologies to learn more about our business IT and cybersecurity services, or contact our team if you are concerned about suspicious Microsoft 365 activity.

Internal Links

• Fox Technologies Business IT and Cybersecurity Services
• Contact Fox Technologies

External Links

• Group-IB HOLLOWGRAPH technical analysis
• Microsoft Graph documentation
• Microsoft guidance on investigating risky users
• UK National Cyber Security Centre cloud security guidance
• The Register coverage of HOLLOWGRAPH

The HOLLOWGRAPH discovery does not make Microsoft 365 calendars inherently dangerous, but it does show how effectively attackers can hide within trusted technology. Businesses that combine secure identities, monitored cloud activity, managed application permissions, endpoint detection and reliable backups will be far better prepared for both this technique and whatever variation appears next.

Disclaimer

This article is provided for educational and informational purposes only. While every effort is made to ensure accuracy, cybersecurity threats, regulations, and technologies change regularly. Readers should seek professional advice before implementing security, compliance, or business decisions based on this content. Fox Technologies accepts no liability for actions taken based on this article.