RESEARCHERS have uncovered a new malware strain dubbed HollowGraph that hijacks Microsoft 365 calendar events to create a covert command and control channel according to Group-IB. The operation appears to be aimed at Israeli entities and is linked with low confidence to the Iranian Lyceum group.
HollowGraph abuses the Microsoft Graph API to write and read specially crafted calendar appointments, often dating them far into the future, for example to the year 2050, to blend with legitimate scheduling data. The malware encrypts its payload and uses DNS tunnelling to exfiltrate stolen files or receive fresh instructions, allowing two-way communication that looks like ordinary calendar activity.
The code shares traits with the Cavern backdoor framework, and Group-IB’s telemetry shows at least twelve compromised systems observed between the first and last sightings on 20 July 2026. While the connection to Lyceum remains low confidence, the tactics match previously reported Iranian‑linked intrusion sets.
First seen at 09:21 UTC and last observed at 12:51 UTC on the same day, the campaign demonstrates active, hands-on-keyboard use of the implanted calendar entries. Defenders should watch for anomalous Graph API calls, especially those creating or modifying events with distant future dates, as a primary indicator of compromise.
Organisations should ensure detailed logging of Graph API requests is enabled and configure alerts for spikes in calendar creation or for service principals that lack legitimate business need to access calendar data. Reviewing consent grants and removing unused third‑party applications can reduce the attack surface.
Applying conditional access policies that restrict Graph API usage to trusted devices and locations, combined with regular threat‑hunting queries that search for unusual subject lines or attachments in calendar items, will help detect HollowGraph before it can establish a persistent channel.