HollowGraph Malware Uses Microsoft 365 for Espionage

A newly discovered malware called HollowGraph uses Microsoft 365 calendars to transmit its commands and transport stolen data. This technique allows the malware's activities to be disguised as legitimate Microsoft Graph API traffic. According to the cybersecurity firm Group-IB, the malware was developed to conduct targeted espionage operations. HollowGraph hides its commands and stolen files in calendar entries dated for the year 2050. This method ensures that the malware's communication is not immediately recognized as suspicious.

The use of future dates in calendar entries is an innovative technique that enables attackers to obscure their activities. The malware is designed to communicate via the Microsoft Graph API, meaning that data transfer occurs through regular Microsoft services. This complicates detection by security solutions that target suspicious activities in networks. Attackers can thus send instructions to the malware and extract data without being noticed. Group-IB has found that the malware is capable of stealing sensitive information stored in the victims' calendars.

This may include confidential business data, appointments, and other critical information. The attackers can then use this data for their own purposes or sell it to third parties. The discovery of HollowGraph raises questions about the security of cloud services, particularly regarding the use of Microsoft 365. Companies utilizing these services should review their security protocols and ensure they have the latest protective measures in place. Implementing multi-factor authentication could be one way to minimize the risk of such attacks.

The malware exemplifies the increasing complexity of cyberattacks, which are constantly evolving. Attackers are employing ever more sophisticated techniques to achieve their goals. The security community must adapt and develop new strategies to counter such threats. The exact spread of HollowGraph is currently unclear; however, it is believed to target companies and organizations that use Microsoft 365. The malware could potentially be deployed across various sectors, including financial services, healthcare, and government agencies.

Cybersecurity firm Group-IB has already taken steps to warn affected companies and assist them in combating the malware. Experts recommend monitoring all suspicious activities in Microsoft 365 accounts and regularly performing security updates. A proactive approach is crucial to minimize the impact of such attacks. The discovery of HollowGraph underscores the need for continuous improvement of security infrastructure within organizations. Cybercrime is constantly evolving, and companies must remain vigilant to protect their data and systems.

The vulnerability exploited by this malware could have serious consequences for the affected organizations. Group-IB has classified the malware as a serious threat and advises companies to take immediate action to secure their systems. The exact number of affected users and organizations is not yet known; however, a comprehensive investigation is recommended. The malware could potentially impact thousands of users utilizing Microsoft 365. The cybersecurity firm plans to release further information about the malware and its operation to better inform the public and businesses. Initial reports about HollowGraph were published in July 2026.