Malware & Threats New HollowGraph Malware Abuses Microsoft 365 Calendar for C&C Communication Part of a larger toolkit, HollowGraph uses a compromised 365 account’s calendar as a two-way dead-drop. By Ionut Arghire | July 21, 2026 (7:55 AM ET) Flipboard Reddit Whatsapp Whatsapp Email A recently discovered piece of malware abuses the Microsoft 365 calendar for command-and-control (C&C) communication, Group-IB reports. Dubbed HollowGraph , the malware is believed to be part of a larger toolkit and is likely linked to Cavern Manticore , an Iran-nexus threat actor that Check Point detailed earlier this month. The malware’s communication mechanism relies on the Microsoft Graph API and a compromised 365 account in Israel to hide its C&C communication within legitimate traffic. “Using the Microsoft Graph API, it treats the compromised mailbox’s calendar as a two-way dead-drop: operators plant tasking as calendar events, and the implant exfiltrates stolen files by creating its own events with encrypted data attached,” Group-IB explains. The payloads are attached to events as files, and the events are dated far in the future (13 May 2050) to avoid alerting the mailbox owner. The malware uses hybrid RSA + AES encryption to secure the payloads. Additionally, HollowGraph retains a secondary communication channel, performing DNS tunneling to refresh its configuration and Microsoft Entra ID (Azure AD) credentials it uses for authentication. Advertisement. Scroll to continue reading. Group-IB identified 12 HollowGraph victims, including three that were actively communicating with the attackers’ infrastructure. The earliest observed communication occurred on June 3, suggesting that the malware has been deployed in attacks since at least last month. “The recovered indicators — an Israeli mailbox used for exfiltration and malware samples uploaded from Israel — suggest a focused interest in Israeli entities rather than broad, opportunistic compromise,” the company notes. HollowGraph never reaches out to an attacker-controlled server for payload delivery. Instead, it relies on two supported commands: ‘send’ to generate calendar appointments with attached files, and ‘get’ to search for appointments planted by the operator and download new instructions. The malware’s hardcoded configuration, which contains the Microsoft Entra ID tenant ID, client ID and secret, target mailbox address, C&C domain, and two RSA keys, is written to disk as logAzure.txt upon execution. Based on command format and structure, Group-IB believes that HollowGraph is part of a variant of the Cavern framework, but attributes it to the Iran MOIS-linked OilRig subgroup Lyceum (also known as Hexane and SiameseKitten) with low confidence. “Based on the evidence currently available, we cannot confidently attribute this activity to any previously identified threat actor. However, our analysis identified several technical similarities with the Iranian-nexus threat actor Lyceum. While these overlaps are noteworthy, they are not sufficiently unique to support a high-confidence attribution,” Group-IB notes. Related: In Other News: Iran Tracks US Military Phones, CrashStealer macOS Malware, CVD Blueprint Related: China-Linked APT GopherWhisper Abuses Legitimate Services in Government Attacks Related: Multiple Jscrambler Packages Impacted by Supply Chain Attack Related: GigaWiper Combines Multiple Malware for System-Level Sabotage Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire OpenSSL Silently Fixes ‘HollowByte’ DoS Vulnerability Ernst & Young Data Breach Affects Personal, Financial Information Hugging Face Hacked in Autonomous AI Attack Chrome 150 Update Patches Severe Memory Safety Bugs Beacon Security Raises $13 Million for Security Data Platform Cyberattack Disrupts Operations of Japanese Frozen Food Giant Nichirei Risk Ledger Raises $32 Million in Series B Funding Fresh SharePoint Vulnerability Exploited Soon After Disclosure Latest News CISO Conversations: Andreas Gaetje – From Economics to CISO at Körber AG Estée Lauder Discloses Impact From Oracle EBS Zero-Day Hack Meta Paid $78,000 Bounty for Vulnerability Exposing Customer Support Data Clover Health Investments Discloses Data Breach Exploitation of ServiceNow Vulnerability Seen Days After Disclosure Zimbra Update Patches Critical Vulnerabilities Neo Emerges From Stealth With $100M to Control and Secure Enterprise AI Software SonicWall Zero-Days Exploited to Deliver Custom Malware for Weeks Before Patch Trending Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Closing the Exploitation Gap July 22, 2026 Join this live webinar as we explore why exploitation is outpacing remediation, where risk is growing fastest, and what security leaders can do to close the gap before attackers take advantage. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the Move Jazz has named Sean Robinson, Rickie Goyal, Danielle Guetta, Shani Nago, and Lior Magram as VPs and Michael Calev as COO. AJ Shipley has been appointed Chief Product Officer at CrowdStrike. Brinqa has named Ron Dovich as Chief AI and Automation Officer, David Allen as CTO, Steve Biagioni as CFO, and James Walta as VP of Product. More People On The Move Expert Insights Legacy Systems, Real-World Impacts: The Reality of OT Security Legacy systems, safety concerns, and critical infrastructure risks make OT vulnerability disclosure one of cybersecurity's most challenging balancing acts. (Tod Beardsley) The Shift Toward Business-Aligned Risk Management Moving from isolated, technical data to a continuous risk lifecycle can help organizations align security controls with actual business consequences. (Steve Durbin) How to Conduct a Successful Audit of AI-Driven Software Development As AI-generated code becomes commonplace, CISOs need new audit strategies to measure developer practices, govern AI tool usage, and identify software risks before they reach production. (Matias Madou) Frontier AI: Six Questions Every Enterprise Should Ask Security Vendors From model selection and automation to validation and measurable results, the right questions can help enterprises separate genuine AI capabilities from marketing hype. (Joshua Goldfarb) The AI Token Costs That Can Break Cybersecurity As cybersecurity platforms embrace agentic AI, organizations must balance detection performance against the escalating costs of token consumption, deployment architecture, and AI credits. (Danelle Au) Flipboard Reddit Whatsapp Whatsapp Email