Watch out - that Microsoft Calendar invite dated 2050 could be hiding stolen files and worse

Top view of woman holding smartphone and tablet with calendar on desk.

• Group‑IB discovers HollowGraph malware targeting Israeli entities, exfiltrating files via Microsoft Graph API
• Operators hide instructions in future calendar entries, then attach encrypted stolen data to events
• At least 12 systems were compromised; overlaps with Lyceum noted but attribution remains low‑confidence

Cybercriminals have found a way to communicate with the malware installed on victim devices through compromised Microsoft Calendar apps, experts have warned.