Hackers Exploit Google Calendar API with Serverless MeetC2 Framework

Hackers have demonstrated a novel serverless command-and-control technique, dubbed MeetC2, that abuses Google Calendar APIs to hide traffic inside trusted cloud services. According to GBHackers, the approach uses a minimal organiser and guest agent that talk to standard Calendar API endpoints, with communications routed entirely through oauth2.googleapis[.]com and www.googleapis[.]com.

The guest agent polls the Calendar events endpoint every 30 seconds, while the organiser injects commands into the summary of newly created events and the guest writes outputs back into the description via a PUT request. The method requires no dedicated server infrastructure and relies on a calendar shared with a service account that has event-modification permissions, after enabling the Calendar API in a Google Cloud project and using a credentials.json file.

In practical tests, commands such as whoami and uname -a were executed without triggering common detections, highlighting the need for deeper service-level telemetry and anomaly detection within trusted SaaS domains. The MeetC2 project is open-source on GitHub, and blue teams are urged to monitor for high-frequency calendar activity and unusual payload content to surface covert channels.