Signal
HollowGraph malware uses Microsoft 365 calendars for covert command and data theft
Evidence first: scan the strongest sources, then decide whether to go deeper.
Published 2026-07-20 12:30 UTCUpdated 2026-07-20 14:59 UTC
rss
malwarethreat_actorsecurity_toolingincident_response
Trend in the last 24h
Current brief openSource links open
This current signal is open on the public brief with summary, metadata, source links, and full evidence. Pro adds compare-over-time, alerts, exports, and workflow.
No card needed for the free brief.
Evidence trail (top sources)
top sources (3 domains)domains are deduped. counts indicate coverage, not truth.3 top sources shown
Overview
Security researchers have uncovered HollowGraph, a new espionage malware that hijacks Microsoft 365 calendars to hide command-and-control (C2) communications and stolen files.
Entities
MicrosoftHollowGraphCavern
Score total
1.22
Momentum 24h
3
Posts
3
Origins
3
Source types
1
Duplicate ratio
0%
Why now
- HollowGraph was recently discovered, revealing a novel malware tactic targeting Microsoft 365 users.
- The use of calendar events dated far in the future is a new evasion method to avoid suspicion.
- Organizations relying on Microsoft 365 should be aware of emerging threats exploiting cloud collaboration tools.
Why it matters
- HollowGraph demonstrates how malware can abuse trusted cloud services for stealthy espionage.
- Using legitimate Microsoft Graph API traffic makes detection by traditional security tools challenging.
- This technique highlights the need for enhanced monitoring of cloud application behaviors.
LLM analysis
Topic mix: lowPromo risk: lowSource quality: medium
Recurring claims
- HollowGraph malware uses Microsoft 365 calendars to hide command-and-control communications and stolen files.
How sources frame it
- The Hacker News: neutral
- The Register Security: neutral
- Infosecurity Magazine: neutral
All evidence
All evidence
The Hacker News
thehackernews.com · thehackernews.com · 2026-07-20 14:33 UTC
Microsoft 365 calendars become spy drop boxes in HOLLOWGRAPH campaign
The Register Security · theregister.com · 2026-07-20 14:59 UTC
New HollowGraph Malware Hijacks Microsoft 365 Calendars for Covert C2 Communications
Infosecurity Magazine · infosecurity-magazine.com · 2026-07-20 12:30 UTC
Show filters & breakdown
Posts loaded: 0Publishers: 3Origin domains: 3Duplicates: -
Showing 3 / 0
Top publishers (this list)
- thehackernews.com (1)
- The Register Security (1)
- Infosecurity Magazine (1)
Top origin domains (this list)
- thehackernews.com (1)
- theregister.com (1)
- infosecurity-magazine.com (1)