Malware Hiding Commands Inside Microsoft 365 Calendar Events

By Geoffrey Wenger Published July 20, 2026

Category: Cybersecurity

Tags: Cloud Security Credential Theft endpoint security Incident Response Malware Microsoft

Microsoft 365 calendars usually hold meetings, reminders, and deadlines, not malware commands. Yet researchers found a Windows threat called HOLLOWGRAPH that turns a hacked calendar into a hidden communication channel. It stores encrypted instructions and stolen files inside events set decades into the future. The attack was small and targeted, but the method shows how criminals can misuse trusted cloud tools without drawing much attention.

How HOLLOWGRAPH Uses Calendar Events

HOLLOWGRAPH is a Windows malware component tied to a larger backdoor system called Cavern. Instead of depending only on a strange website or command server, it uses a compromised Microsoft 365 calendar to pass instructions and stolen files.

The original HOLLOWGRAPH malware analysis from Group-IB explains that the malware reaches the calendar through the Microsoft Graph API. Microsoft Graph is a real, widely used service. Approved apps use it to work with calendars, email, files, users, and other Microsoft 365 data.

That normal connection is what gives HOLLOWGRAPH cover.

Most malware talks to a server controlled by the attacker. A firewall, antivirus tool, or DNS filter may spot the odd destination and block it. HOLLOWGRAPH takes another path. Its traffic goes to Microsoft systems that a company may already contact hundreds or thousands of times each day.

The hacked calendar works like a digital drop box. The attacker leaves an encrypted command in an event attachment. Later, the malware finds the event, downloads the file, and unlocks the instructions. When it needs to steal information, it creates another event and attaches the encrypted data.

The malware uses two main operations:

The get operation finds an event made by the attacker, downloads the attached file, and decrypts the command.
The send operation encrypts a file from the infected computer, creates a calendar event, and uploads the data as an attachment.

Security teams call this command-and-control communication, or C2. The attacker does not need a constant direct connection to the infected computer. Both sides simply know where to leave and collect information.

The employee may never see any of it. Once the device and Microsoft 365 access have been compromised, the malware can work with the hidden calendar events in the background.

Why the Malware Uses May 13, 2050

The HOLLOWGRAPH samples studied by researchers used calendar events dated May 13, 2050. Nothing in the research suggests that this date has a special meaning. It is useful because it sits far outside the period most people ever check.

Most employees view their calendars by the day, week, or month. Some look several months ahead. Almost nobody scrolls more than 20 years into the future to inspect a random appointment.

That makes 2050 a convenient hiding place.

Group-IB’s technical findings on HOLLOWGRAPH show that the malware searches the part of the calendar containing that date. The attacker knows where to place new commands, and the malware knows where to find them. Files taken from the computer can be stored in the same distant calendar range.

This setup lowers the chance that the mailbox owner will stumble across a suspicious event during normal work. It also lets the attacker use storage inside a service the company already trusts.

Still, a far-future event does not prove that malware is present. Businesses may create long-term reminders for leases, warranties, software licenses, certificates, contracts, or record-retention dates. Developers may also use distant dates while testing calendar tools.

An event becomes more concerning when several strange details appear together:

It is scheduled many years or decades ahead.
It contains an attachment with no clear business purpose.
Its subject includes repeated task codes or numbers.
It appears to have been created by an unknown app.
Several similar events appear around the same future date.

May 13, 2050, is tied to the known HOLLOWGRAPH samples. Another attacker could choose a completely different year. A proper review should not focus on one date alone.

It Is Not an Invitation-Based Attack

HOLLOWGRAPH is not the same as calendar spam, fake meeting requests, or phishing invitations.

The research does not show that a person becomes infected just by receiving an odd Outlook event. Opening a normal calendar invitation does not install HOLLOWGRAPH. There is also no evidence that Microsoft 365 calendars are widely spreading this malware to ordinary users.

The calendar comes into play after a deeper compromise has already happened.

The attacker first needs malware running on a Windows computer. The attacker also needs credentials or application access that lets the malware work with a chosen Microsoft 365 mailbox.

Microsoft explains that apps can use app-only Microsoft Graph authentication to reach approved resources under their own identities. This setup requires application permissions, administrator consent, and a valid credential such as a client secret or certificate.

Group-IB found configuration details that included a Microsoft Entra tenant ID, client ID, client secret, and target mailbox. Those details allowed HOLLOWGRAPH to identify itself and communicate through Microsoft Graph.

In other words, the calendar is being used as hidden infrastructure after access has been gained. It is not necessarily how the computer was infected in the first place.

Researchers also found no sign that HOLLOWGRAPH depends on a new flaw in the Microsoft 365 calendar service. It abuses real features through stolen or misused access.

That difference matters. A strange calendar event deserves attention, but it does not mean the computer became infected simply because the event appeared. The bigger questions are how the device was breached, which credentials were exposed, what permissions the attacker had, and whether any data left the company.

Why Microsoft Traffic Can Blend In

Many security tools look at where a computer connects. A device that repeatedly reaches out to a new, obscure, or known harmful domain may quickly trigger an alert.

Microsoft Graph traffic is harder to judge that way.

Outlook, Teams, OneDrive, backup tools, scheduling services, business software, and internal apps may all use Microsoft Graph. Blocking the entire service would break normal work across many organizations.

Microsoft describes Microsoft Graph as a gateway to information and services across Microsoft 365 and Microsoft Entra. That broad use creates noise, and attackers can try to hide inside it.

HOLLOWGRAPH reaches a trusted destination. The problem is what it does after the connection is made.

The malware also encrypts the files stored in calendar events. Group-IB reported that it used RSA and AES-256-GCM encryption, with different key material for commands coming in and stolen data going out. Without the correct keys, the contents are harder to read.

Even so, HOLLOWGRAPH is not impossible to detect.

Endpoint-security software may find the malicious DLL, unusual processes, suspicious files, persistence methods, or other related behavior. Microsoft 365 logs may also reveal odd calendar searches, attachment uploads, event creation, or activity from an app nobody recognizes.

The key point is simple: a trusted web address does not guarantee trusted behavior.

Security teams need to ask which user or app made the request, what permissions it had, what it accessed, and whether the activity fits the company’s normal pattern.

App Credentials Add Another Weak Point

Multifactor authentication is still one of the best ways to protect Microsoft 365 user accounts. It can stop an attacker who has a stolen password but cannot complete the second sign-in step.

However, application credentials create a different problem.

Apps do not always need an employee to approve each action. Microsoft’s explanation of the OAuth client credentials flow shows how an application can sign in as itself and use permissions that were granted earlier.

A stolen client secret is not the same as a stolen user password.

Multifactor authentication for employees does not automatically cancel an application secret. If the attacker has a valid secret or certificate linked to useful permissions, the app may keep working until the credential expires, is removed, or loses access.

Businesses must protect two connected identity areas:

User identity includes passwords, multifactor authentication methods, browser sessions, recovery options, tokens, and sign-in records.
Application identity includes app registrations, service principals, OAuth permissions, client secrets, certificates, consent grants, and tokens.

Administrators should know why every connected app exists. They should also know who owns it and what information it can reach.

Old apps are easy to forget. A company may stop using a tool but leave its access in place for years. That creates needless risk, especially when the app can read mailboxes, calendars, files, or directory data.

Client secrets need careful handling as well. They may be copied into configuration files, shared with the wrong person, exposed in source code, or left active after a vendor relationship ends.

Microsoft recommends stronger options such as managed identities, federated credentials, or certificates when they fit the situation. Shorter credential lifetimes and regular rotation also reduce the damage a stolen secret can cause.

Warning Signs Worth Checking

Most companies will probably never face HOLLOWGRAPH itself. Even so, its behavior offers useful clues that can point to other forms of Microsoft 365 abuse.

One unusual event does not prove an attack. A backup service, customer-management system, booking platform, or internal tool may use Microsoft Graph for a valid reason.

What matters is whether the activity makes sense inside that company.

Microsoft provides steps for finding and removing illicit application consent. These checks can help uncover apps that received access through a fake consent request, a compromised administrator, or an unauthorized change.

Administrators should pay attention to combinations of unusual behavior, such as:

Calendar events dated decades into the future.
Attachments inside events with no clear purpose.
Repeated subjects containing codes or task numbers.
Events created by an unfamiliar application.
Sudden jumps in calendar searches or uploads.
New apps with broad mailbox or file access.
Client secrets added by an unknown administrator.
OAuth consent granted to an app nobody approved.
Graph activity from an unexpected device or location.
Repeated DNS lookups to unrelated domains.

Context still matters. A future-dated appointment may be harmless. A newly added application may be part of a real project.

Concern should rise when no owner, ticket, vendor, or business reason explains the activity.

Useful Microsoft 365 Security Checks

A small company does not need a large security operations center to review Microsoft 365. It does need an administrator who understands the environment and knows which apps should be connected.

Start with enterprise applications and app registrations in Microsoft Entra. Check the owner, purpose, assigned users, permissions, certificates, and client secrets for each one. Focus first on apps that can reach mailboxes, calendars, files, directories, or many user accounts.

Next, look at credential age and ownership. A secret created by an unknown person, one with a very long lifespan, or one tied to an abandoned app deserves attention.

Do not delete an unfamiliar credential without checking it first. A real application secret may support payroll, backups, customer records, reporting, or automated tasks. Removing it without preparation could stop an important service.

Administrators should also examine audit records. Microsoft’s instructions for searching the Purview audit log explain how approved users can review mailbox, application, user, and administrator activity.

Larger organizations may also enable Microsoft Graph activity logs. These logs record Graph API requests processed for the tenant and can be sent to tools such as Log Analytics, Azure Storage, or a security monitoring platform.

Windows protection is just as important.

HOLLOWGRAPH could use the calendar only because malware was already running on a Windows system. Keep Windows, browsers, Microsoft Office, and security software updated. Limit local administrator rights. Investigate unknown DLLs, scheduled tasks, startup items, PowerShell activity, and unexplained security exclusions.

Cloud logs may reveal suspicious access. Endpoint tools may reveal the malware itself. Neither view is enough on its own.

How to Respond to Suspicious Activity

Strange calendar events, unknown application credentials, or unusual Microsoft Graph traffic should not be treated as a simple Outlook issue. They may point to a larger compromise involving a Windows computer, cloud account, application registration, or stolen data.

Deleting the events will not solve the full problem.

Removing a calendar entry does not remove malware from the computer. It also does not cancel the credentials used to reach Microsoft Graph or show whether files have already been taken.

Microsoft’s compromised application playbook gives organizations a structured process for investigating apps that may have been taken over or used for harmful activity.

A business with credible signs of compromise should consider these steps:

Isolate the affected Windows computer from the network.
Save relevant logs, files, and calendar-event details.
Disable confirmed harmful apps or service principals.
Remove unauthorized OAuth consent and Graph permissions.
Rotate exposed secrets, certificates, and passwords.
Revoke active sessions and tokens when needed.
Review mailbox, file, calendar, and directory activity.
Search other computers and accounts for related signs.
Contact an incident-response expert if sensitive data may be exposed.

Move quickly, but do not destroy evidence. Deleting logs, events, and applications too early can make it harder to learn how the attack happened or whether another route into the company is still open.

How JENI® Helps Maintain Windows

JENI® is not antivirus software, an endpoint detection service, or a Microsoft 365 monitoring platform. It does not directly detect HOLLOWGRAPH or inspect Microsoft Graph activity.

Its purpose is different.

JENI® helps users maintain and repair Windows by running native operating-system tools, clearing unnecessary files, fixing selected network problems, and creating local reports. A stable computer can make updates, repairs, scans, and troubleshooting more reliable.

That makes maintenance one part of a stronger security baseline, but only one part.

Businesses still need reputable endpoint protection, current Windows updates, controlled administrator access, secure backups, Microsoft 365 logs, and regular application-permission reviews.

No maintenance utility can make up for stolen credentials, excessive cloud access, or an active backdoor. JENI® works best beside dedicated security tools, not in place of them.

Trusted Cloud Apps Still Need Review

HOLLOWGRAPH matters because of the method it used, not because it caused a broad Microsoft 365 outbreak.

Group-IB found at least 12 infected systems, with about three actively communicating during the investigation. The evidence pointed to a focused espionage campaign involving organizations in Israel, not a mass attack against everyday Microsoft 365 customers.

That limited scope is reassuring. The larger lesson is not.

Cloud services handle a huge share of daily business activity. Their familiar domains, encrypted traffic, and constant background connections can give attackers room to hide when a device, account, app, secret, or token has been compromised.

Microsoft’s application security recommendations encourage organizations to protect app credentials, reduce the use of client secrets, shorten credential lifetimes, and use stronger identity methods where possible.

Businesses do not need to abandon Microsoft 365. They need a clearer view of who and what is using it.

Multifactor authentication, endpoint protection, DNS filtering, audit logs, shorter secret lifetimes, and regular app reviews all make this kind of hidden activity harder to maintain.

An appointment dated May 13, 2050, may look too distant to matter. That was the advantage. HOLLOWGRAPH used a place people trusted, rarely visited, and had little reason to question.

Microsoft Calendar Malware FAQs

Can an Outlook invitation install HOLLOWGRAPH?

There is no evidence that HOLLOWGRAPH installs because someone receives or opens a standard Outlook invitation. The malware uses a compromised calendar after attackers already have access to a Windows computer and Microsoft 365 resources.

Does HOLLOWGRAPH exploit Microsoft 365?

The available research does not describe an unpatched Microsoft 365 calendar flaw. HOLLOWGRAPH abuses legitimate Microsoft Graph features through compromised application credentials and mailbox access.

Should businesses search only in 2050?

No. May 13, 2050, is linked to the known samples, but another attacker could choose any distant date or calendar range.

Can multifactor authentication stop it?

Multifactor authentication protects user accounts from many password attacks, but it does not automatically cancel a stolen application secret. Companies must also review app registrations, OAuth consent, permissions, certificates, and client credentials.

Will deleting the events remove it?

No. Deleting suspicious calendar events does not remove malware from an infected computer, cancel exposed credentials, end active sessions, or show whether data has already been stolen.