HollowGraph malware hides C2 commands and exfiltrated data inside encrypted Microsoft 365 calendar events dated 2050, using the Graph API to blend into legitimate cloud traffic.

HollowGraph uses Microsoft 365 calendar events dated to 2050 to receive commands and exfiltrate encrypted files through legitimate Graph API traffic.

Malware hides commands in appointments set for 2050 and uses Redmond's own cloud to phone home