New Malware Hides in Microsoft 365 Calendars: How to Protect Your Business Account

Security researchers discovered a new type of spying software called HollowGraph that uses Microsoft 365 calendars in a sneaky way. The malware creates calendar events dated far in the future, specifically to the year 2050, and uses those fake events to hide instructions for hackers and stolen files. Because it uses legitimate Microsoft calendar features, the malicious activity looks like normal Microsoft 365 traffic, making it very hard to detect. This threat primarily affects businesses and organizations that use Microsoft 365 for email and calendars. If hackers install this malware on a work computer, they can steal files and data while hiding their tracks in the calendar system. Home users with personal Microsoft 365 accounts face lower risk because this type of sophisticated espionage malware typically targets organizations, not individual families. However, anyone using Microsoft 365 should be aware that calendar systems can be abused.

If you use Microsoft 365 at work, stay alert for unusual activity.

1. Check your calendar occasionally for strange events, especially any scheduled far in the future like

3. Report any suspicious calendar entries to your IT department immediately.