HollowGraph uses Microsoft 365 calendar events dated to 2050 to receive commands and exfiltrate encrypted files through legitimate Graph API traffic.

HollowGraph uses Microsoft 365 calendar events dated to 2050 to receive commands and exfiltrate encrypted files through legitimate Graph API traffic.

Malware hides commands in appointments set for 2050 and uses Redmond's own cloud to phone home

A malicious component dubbed HollowGraph uses the calendar feature in compromised Microsoft 365 mailboxes as a command-and-control channel to receive attacker commands and…

The HollowGraph malware abuses Microsoft Graph API and a compromised 365 account’s calendar for C&C communication.