HollowGraph Malware Uses M365 Calendar Events Dated 2050 as C2 Channel

Tue, 21 Jul 2026 12:43:35 +0000

Engineer — Plan: Novel Graph API abuse using calendar write access highlights over-permissioned OAuth app risk. Audit which apps hold Microsoft Graph calendar read/write scopes and revoke unnecessary permissions this quarter.
SOC/IR — Act: The year-2050 calendar event timestamp is a highly specific, huntable indicator — sweep M365 audit logs for calendar events created with 2050 dates and flag Graph API calls that write calendar entries with large attachments.
Leader — Learn: Espionage actors using legitimate Microsoft 365 infrastructure for C2 blurs the line between sanctioned SaaS activity and intrusion; useful context for understanding the M365-as-attack-surface risk but no immediate leadership action required.

C2-Abuse on CuraSec