HOLLOWGRAPH Malware Exploits Microsoft 365 Calendars for Espionage

## Executive summary HOLLOWGRAPH is a sophisticated Windows malware campaign that abuses the Microsoft Graph API and Microsoft 365 calendar appointments (appointments dated far in the future) to receive commands and exfiltrate files; it's linked to the Cavern backdoor, uses DNS tunneling for credential renewal, and hybrid RSA/AES encryption, with 12 confirmed Israeli infections observed between 3 June and 9 July 2026 and suspected nation-state (possible Iranian) attribution.