Researchers Discover Malware Leveraging Microsoft 365 for Covert Command-and-Control Communications

Researchers identified a malicious component known as HollowGraph that exploits the calendar function in compromised Microsoft 365 mailboxes to establish…

Security teams should review activity logs in Microsoft 365, particularly abnormal calendar changes in compromised mailboxes. Implement monitoring for unusual calendar synchronization patterns and consider restricting permissions on applications connected to M365 to limit attack surface. Check for HollowGraph indicators of compromise in your environment.