APT41 malware abuses Google Calendar for stealthy C2 communication

APT41 deployed a sophisticated multi-stage Windows malware (PlusDrop → PlusInject → ToughProgress) delivered via a malicious LNK and image-disguised payloads; the final stage performs in-memory process hollowing and uses Google Calendar event descriptions as an encrypted C2 channel to receive commands and return results. Google discovered and terminated attacker-controlled Workspace accounts and calendar events, updated Safe Browsing blocklists, and shared samples and traffic logs with affected parties to help detect infections.