A newly identified espionage implant named HollowGraph transforms compromised Microsoft 365 calendars into covert channels for receiving instructions and exfiltrating stolen files. The malware schedules events for 13 May 2050, a date far in the future that significantly lowers the chance an account owner will notice the suspicious entries.
Built as a Windows DLL, HollowGraph communicates exclusively through the Microsoft Graph API. By mixing its traffic with normal corporate service activity, the implant avoids direct connections to attacker infrastructure and thereby evades many domain-based detection mechanisms.
The malware implements two core commands. The “get” function retrieves instructions attached to calendar appointments previously created by the operators, while the “send” function encrypts collected data and uploads it as attachments to newly created events.
All files are protected with a hybrid encryption scheme combining RSA and AES-256-GCM. Separate key pairs are used for inbound commands and outbound exfiltration, ensuring that compromise of one direction does not automatically expose the entire communication flow.
Stolen information is written to a file named logAzure.txt, which is deliberately disguised as an ordinary log to avoid raising suspicion during manual inspection.
Investigators have confirmed at least 12 infected systems, approximately three of which maintained active communication during the observation window. Activity was recorded between 3 June and 9 July 2026 and appears focused on Israeli organizations.
