Hollow Graph Malware Hides C2 and Stolen Files in Microsoft 365 Events Dated 2050

Summary: Group-IB named a .NET DLL implant HollowGraph that uses a compromised Microsoft 365 mailbox's calendar as a two-way command channel, reading operator instructions from an event dated 2050-05-13 and exfiltrating encrypted stolen files as attachments on its own far-future events. The malware refreshes its Entra ID client credentials over DNS via IPv6 AAAA records from cloudlanecdn[.]com, writing them to a file disguised as logAzure.txt, and Group-IB found it on at least 12 machines with victim traffic from 3 June to 9 July 2026.
Bottom line: There is no vulnerability and no patch here: the implant rides a stolen account and normal Graph API traffic, so the only signals are application-driven calendar changes and client secrets you may never have audited. Group-IB ties the code to Cavern with high confidence but will not name the operator, and traffic was still flowing as of 9 July.

Read the original at The Hacker News ↗