--- title: Microsoft 365 calendars become spy drop boxes in... description: A threat campaign dubbed HOLLOWGRAPH abuses Microsoft 365 calendar appointments — set far in the future (year 2050) — as covert command-and-control drop boxes... canonical: https://daily.dev/posts/microsoft-365-calendars-become-spy-drop-boxes-in-hollowgraph-campaign-dvwdrv7bj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Microsoft 365 calendars become spy drop boxes in HOLLOWGRAPH campaign | daily.dev og:description: A threat campaign dubbed HOLLOWGRAPH abuses Microsoft 365 calendar appointments — set far in the future (year 2050) — as covert command-and-control drop boxes... og:url: https://daily.dev/posts/microsoft-365-calendars-become-spy-drop-boxes-in-hollowgraph-campaign-dvwdrv7bj og:image: https://api.daily.dev/og/posts/DvWdRv7bJ.png og:image:alt: Microsoft 365 calendars become spy drop boxes in HOLLOWGRAPH campaign og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Microsoft 365 calendars become spy drop boxes in HOLLOWGRAPH campaign **[The Register](https://daily.dev/sources/theregister)** · 3 min read · 0 upvotes · 0 comments ## Summary A threat campaign dubbed HOLLOWGRAPH abuses Microsoft 365 calendar appointments — set far in the future (year 2050) — as covert command-and-control drop boxes for malware. The technique leverages Microsoft's own cloud infrastructure to issue commands and receive data, making malicious traffic blend in with legitimate Microsoft 365 communications and harder to detect. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [GhostCode attackers hijack Microsoft 365 accounts with device codes](https://daily.dev/posts/ghostcode-attackers-hijack-microsoft-365-accounts-with-device-codes-czidg2xfc) · CSO Online · 0 upvotes · 0 comments - [Microsoft 365 Copilot – Arbitrary Data Exfiltration Via Mermaid Diagrams – Adam Logue](https://daily.dev/posts/microsoft-365-copilot-arbitrary-data-exfiltration-via-mermaid-diagrams-adam-logue-lezwuj6pt) · Hacker News · 1 upvotes · 0 comments - [The Hacker's 2026 Playbook: Dark Web Tactics Targeting You](https://daily.dev/posts/the-hacker-s-2026-playbook-dark-web-tactics-targeting-you-dk5g8aqns) · Huntress Blog · 0 upvotes · 0 comments - [Hackers target Microsoft 365 accounts with 81 million login attempts](https://daily.dev/posts/hackers-target-microsoft-365-accounts-with-81-million-login-attempts-tnrut3eab) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#microsoft](https://daily.dev/tags/microsoft), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/microsoft-365-calendars-become-spy-drop-boxes-in-hollowgraph-campaign-dvwdrv7bj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Microsoft 365 calendars become spy drop boxes in HOLLOWGRAPH campaign","url":"https://daily.dev/posts/microsoft-365-calendars-become-spy-drop-boxes-in-hollowgraph-campaign-dvwdrv7bj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/microsoft-365-calendars-become-spy-drop-boxes-in-hollowgraph-campaign-dvwdrv7bj"},"datePublished":"2026-07-20T15:00:07.969Z","dateModified":"2026-07-21T08:47:33.745Z","description":"A threat campaign dubbed HOLLOWGRAPH abuses Microsoft 365 calendar appointments — set far in the future (year 2050) — as covert command-and-control drop boxes...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b634f781e6128a7ac383ff8fa8b586dd?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b634f781e6128a7ac383ff8fa8b586dd?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Register","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Register","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/66aa2113fdad463992ffcbf0e8963fda","url":"https://daily.dev/sources/theregister"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/microsoft-365-calendars-become-spy-drop-boxes-in-hollowgraph-campaign-dvwdrv7bj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,microsoft,malware","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Register","item":"https://daily.dev/sources/theregister"},{"@type":"ListItem","position":3,"name":"Microsoft 365 calendars become spy drop boxes in HOLLOWGRAPH campaign"}]} ```