Microsoft 365 calendars become spy drop boxes in HOLLOWGRAPH campaign

Microsoft 365 calendars are being abused by a malware component named HOLLOWGRAPH that hides encrypted commands and stolen files inside calendar events (all dated May 13, 2050) and uses legitimate Microsoft Graph API requests plus periodic DNS tunneling to refresh Entra ID credentials, enabling stealthy command-and-control and data exfiltration; Group-IB links it to the Cavern framework, notes low-confidence similarity to Lyceum, and observed a narrow, targeted campaign affecting 12 systems.