HOLLOWGRAPH malware turns Microsoft 365 calendars into an espionage channel

Group-IB discovered HOLLOWGRAPH, an espionage malware that uses Microsoft 365 calendar events and the Graph API to receive commands and exfiltrate encrypted files (attachments dated in 2050), while using DNS-based IPv6 lookups for credential renewal; they link it to the Cavern modular backdoor and observe 12 infected systems (targeting Israeli entities) active June–July 2026, and provide IOCs and detection guidance for Microsoft 365/Entra ID.