New Malware Weaponizes Microsoft 365 Calendar to Hide Attack Commands and Stolen Data

A Clever New Hiding Spot for Cybercriminals

Security researchers have uncovered a troubling new technique where attackers are using Microsoft 365 calendar applications as a secret storage locker for their malicious operations. Instead of leaving obvious traces on servers or infected computers, criminals are embedding their command instructions and stolen information directly into calendar events—specifically ones timestamped for the year 2050.

This malware, which researchers call HollowGraph, represents a shift in how hackers think about hiding their tracks. Rather than breaking into your email inbox or attacking your files directly, they're exploiting a blind spot in how most security tools monitor Microsoft 365.

How the Attack Actually Works

Think of Microsoft 365 calendar events like appointment reminders. Your company's security team typically watches for threats in emails and file transfers, but they rarely scrutinize what's inside calendar invitations. Attackers discovered that calendar events are treated differently by security filters—they slip through with minimal inspection.

By creating calendar entries with dates set far in the future (2050), the malware does two things simultaneously:

• It stores instructions that tell the malware what to do next—essentially leaving notes for itself on how to behave
• It holds onto copies of files stolen from your company, keeping them hidden in plain sight within your own Microsoft 365 environment

The calendar events act like a dead drop location in a spy movie—a secret meeting place where information waits to be picked up by the attacker later. Since the events appear to be from the future, older security systems might ignore them completely.

Why You Should Care About This

If your organization relies on Microsoft 365 for email, collaboration, or scheduling, you could be vulnerable. This attack method is particularly dangerous because:

• It's invisible to standard security monitoring. Most IT teams check emails and cloud storage carefully, but calendar events get overlooked.
• Your own trusted tools become the hiding place. Attackers aren't breaking in from outside—they're using services your company already pays for and trusts.
• Stolen data can persist indefinitely. Files stashed in 2050-dated events could sit undetected for years while attackers decide when to retrieve them.

This represents a fundamental problem: as companies improve their defenses in obvious places, attackers look for overlooked corners. Calendar events were that corner.

What You Can Do Right Now

If you manage IT security for your organization, take these steps:

• Review your Microsoft 365 monitoring tools to ensure calendar activity is being logged and analyzed
• Check for any calendar events with unusual dates, especially those set years in the future
• Update your security policies to flag calendar events containing file attachments or suspicious content
• Educate employees about not accepting calendar invitations from unknown senders
• Work with your security vendor to deploy specific detection rules for this malware family

If you're a regular user, be cautious about calendar invitations from unfamiliar addresses and report anything suspicious to your IT department immediately.

This discovery reminds us that attackers will always find new ways to hide—we simply need to keep looking in unexpected places.