--- title: New HollowGraph malware uses Microsoft Graph for... description: A newly discovered malware component called HollowGraph abuses Microsoft 365 calendar events as a covert command-and-control (C2) channel. It authenticates to... canonical: https://daily.dev/posts/new-hollowgraph-malware-uses-microsoft-graph-for-stealthy-c2-comms-q3xemyzol twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: New HollowGraph malware uses Microsoft Graph for stealthy C2 comms | daily.dev og:description: A newly discovered malware component called HollowGraph abuses Microsoft 365 calendar events as a covert command-and-control (C2) channel. It authenticates to... og:url: https://daily.dev/posts/new-hollowgraph-malware-uses-microsoft-graph-for-stealthy-c2-comms-q3xemyzol og:image: https://api.daily.dev/og/posts/q3xEmYZOL.png og:image:alt: New HollowGraph malware uses Microsoft Graph for stealthy C2 comms og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # New HollowGraph malware uses Microsoft Graph for stealthy C2 comms **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 4 min read · 0 upvotes · 0 comments ## Summary A newly discovered malware component called HollowGraph abuses Microsoft 365 calendar events as a covert command-and-control (C2) channel. It authenticates to the Microsoft Graph API using hardcoded credentials from a compromised M365 account, hiding commands and exfiltrated data in calendar entries dated May 13, 2050. Communication is secured with hybrid RSA and AES-256-GCM encryption, with a secondary DNS tunneling channel used to refresh authentication credentials via IPv6 AAAA record queries. Group-IB researchers link HollowGraph to the Cavern C2 framework and note technical similarities with the Iranian-linked Lyceum threat actor. At least 12 systems have been infected, with targets appearing to be organizations in Israel. Defenders are advised to monitor Microsoft Graph audit logs for unusual calendar activity, restrict OAuth client-credential apps, and watch for DNS tunneling patterns. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [New GoGra malware for Linux uses Microsoft Graph API for comms](https://daily.dev/posts/new-gogra-malware-for-linux-uses-microsoft-graph-api-for-comms-vwc7uzrie) · BleepingComputer · 0 upvotes · 0 comments - [Microsoft Graph API Attack Surface: OAuth Flows, Abused Endpoints, and What Defenders Miss](https://daily.dev/posts/microsoft-graph-api-attack-surface-oauth-flows-abused-endpoints-and-what-defenders-miss-rdgiqytop) · InfoSec Write-ups · 0 upvotes · 0 comments - [Exploiting Google Gemini to Abuse Calendar Invites Illustrates AI Threats](https://daily.dev/posts/exploiting-google-gemini-to-abuse-calendar-invites-illustrates-ai-threats-j6bbmlvcw) · Security Boulevard · 0 upvotes · 0 comments - [GhostCode attackers hijack Microsoft 365 accounts with device codes](https://daily.dev/posts/ghostcode-attackers-hijack-microsoft-365-accounts-with-device-codes-czidg2xfc) · CSO Online · 0 upvotes · 0 comments --- Tags: [#microsoft](https://daily.dev/tags/microsoft), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/new-hollowgraph-malware-uses-microsoft-graph-for-stealthy-c2-comms-q3xemyzol) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"New HollowGraph malware uses Microsoft Graph for stealthy C2 comms","url":"https://daily.dev/posts/new-hollowgraph-malware-uses-microsoft-graph-for-stealthy-c2-comms-q3xemyzol","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/new-hollowgraph-malware-uses-microsoft-graph-for-stealthy-c2-comms-q3xemyzol"},"datePublished":"2026-07-20T17:43:49.603Z","dateModified":"2026-07-21T08:47:33.745Z","description":"A newly discovered malware component called HollowGraph abuses Microsoft 365 calendar events as a covert command-and-control (C2) channel. It authenticates to...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b4b00e8fb56abaa676d908d34dcc89c0?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b4b00e8fb56abaa676d908d34dcc89c0?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/new-hollowgraph-malware-uses-microsoft-graph-for-stealthy-c2-comms-q3xemyzol","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"microsoft,malware","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"New HollowGraph malware uses Microsoft Graph for stealthy C2 comms"}]} ```