HollowGraph Malware

Technical Analysis

HollowGraph leverages compromised or attacker-provisioned Microsoft 365 accounts, using calendar objects as a covert command-and-control channel: operator instructions are embedded in event descriptions or metadata, while stolen files are attached to events scheduled decades in the future to avoid appearing in normal calendar views and reduce accidental discovery. Because all C2 and exfiltration traffic transits Microsoft Graph API endpoints (graph.microsoft.com) using valid OAuth tokens or compromised credentials, the activity is difficult to distinguish from legitimate M365 usage, defeating domain/IP-based blocklists and much of standard SaaS DLP. This technique is a variant of the broader 'living-off-trusted-services' (LOTS) tradecraft seen in prior APT campaigns abusing Dropbox, Google Drive, Slack, and Teams for stealthy C2. Organizations running AI agents or RAG pipelines that integrate with Microsoft 365 (Graph API-based connectors, calendar/email ingestion for agent context, or automated meeting/document summarization tools) are directly exposed: a compromised M365 tenant could allow attackers to inject malicious instructions or exfiltrate agent-accessible documents through the same trusted Graph API channel the agents rely on, and any OAuth tokens or app credentials used by agent integrations could be harvested and reused for further compromise.

Affected Systems

Microsoft 365 tenants (Exchange Online Calendar, Microsoft Graph API), organizations using OAuth app registrations or delegated permissions for calendar/mail access, third-party integrations and AI agent connectors that consume Microsoft Graph calendar/mail APIs

Indicators of Compromise

• Malware family: HollowGraph
• C2 channel: Microsoft Graph API (graph.microsoft.com) calendar events dated 2050
• Suspicious calendar events with anomalous future dates (year 2050) containing unusual attachments or encoded event descriptions
• OAuth application consent grants with excessive Calendar.ReadWrite / Mail.Read permissions (tenant-specific, not publicly enumerated)

Remediation Steps

1. 1

   Audit calendar events for anomalous dates

   Search Exchange Online / Graph API logs for calendar events with implausible future dates (e.g., year 2050) or unusual attachment activity across all mailboxes.

2. 2

   Review OAuth app consents and API permissions

   Audit all registered Azure AD applications and third-party integrations with Calendar, Mail, or Files Graph API scopes; revoke unused or overly permissive consent grants.

3. 3

   Enable Graph API activity logging and monitoring

   Ensure Microsoft 365 unified audit logging is enabled and configure SIEM alerts for anomalous Graph API calls, especially calendar event creation/modification with attachments from unusual accounts or IP ranges.

4. 4

   Enforce conditional access and MFA

   Require MFA and conditional access policies (device compliance, location-based restrictions) for all accounts with Graph API access to reduce risk of credential-based compromise.

5. 5

   Rotate credentials and tokens for agent/RAG integrations

   For any AI agent or automation pipeline using Microsoft Graph API tokens for calendar/mail ingestion, rotate credentials, scope permissions to least privilege, and monitor for unauthorized token reuse.

6. 6

   Deploy SaaS-aware DLP and CASB controls

   Implement cloud access security broker (CASB) policies capable of inspecting calendar attachments and flagging exfiltration patterns disguised as legitimate M365 traffic.