Hackers Found Using Microsoft 365 Calendar as Secret Messaging System

A Hidden Channel Inside Your Calendar

Researchers have uncovered a sophisticated attack technique where criminals weaponize Microsoft 365 calendar applications to communicate with malicious software installed on compromised networks. Rather than using obvious internet traffic that security tools can detect, attackers embed hidden instructions directly into calendar events within stolen business accounts. This clever approach keeps their malware commands virtually invisible to traditional defense systems.

The malware, known as HollowGraph, operates as part of a larger collection of attack tools. Once a criminal gains access to a legitimate Microsoft 365 account—often through phishing emails or stolen credentials—they essentially create a secret messaging dead-drop. Think of it like leaving coded notes inside a mailbox that only you and your accomplice know about. The calendar becomes a two-way communication channel, with infected machines checking for new "appointments" that actually contain hacker instructions, and reporting back status updates by creating their own calendar entries.

Why This Method Proves So Dangerous

Traditional security software watches for suspicious internet connections and unusual network traffic patterns. But calendar synchronization between devices and Microsoft's servers looks completely legitimate. It's exactly what your calendar should be doing—staying updated across your phone, laptop, and tablet. A security team might notice thousands of calendar updates daily without realizing some contain criminal commands.

This attack is particularly insidious because:

• Calendar traffic blends seamlessly with normal business activity
• Encryption protects the calendar data, hiding malicious content even from network monitoring
• The hijacked account appears to belong to a real employee, bypassing many access restrictions
• Deleting evidence is simple—just remove the calendar entries

The attackers essentially weaponized a feature companies depend on, turning a productivity tool into an espionage instrument.

What This Means for Your Organization

HollowGraph demonstrates how attackers continuously evolve, hiding in plain sight within legitimate business systems rather than launching obvious external attacks.

This discovery exposes a gap in how many companies monitor their cloud environments. While IT teams focus on blocking malware downloads and scanning email attachments, they may completely overlook malicious activity happening inside trusted applications like Microsoft 365. The attack also highlights how one compromised employee account can become a beachhead for sophisticated operations.

Protecting Yourself and Your Company

Organizations should take immediate steps to reduce vulnerability:

• Enable multi-factor authentication on all Microsoft 365 accounts—this makes it exponentially harder for attackers to steal credentials
• Review calendar permissions and restrict who can create or modify events, especially shared calendars
• Monitor unusual calendar activity through Microsoft 365 security logs, looking for suspicious patterns
• Implement conditional access policies that flag logins from unusual locations or devices
• Conduct phishing simulations regularly, since credential theft remains the attack's starting point
• Update detection tools to include behavior monitoring within cloud applications, not just network traffic

Individual users should also stay vigilant about protecting account credentials and immediately report any suspicious calendar entries they didn't create.

As cloud services become central to business operations, attackers will continue finding creative ways to abuse them—making defense-in-depth security essential.