A New Way to Hide in Plain Sight
Security researchers have found a new type of malware that hides its communications inside something almost nobody thinks to check: a calendar. The malware, named HollowGraph, breaks into Microsoft 365 accounts and then uses the built-in calendar feature to receive instructions from attackers and send stolen files back out.
Instead of contacting a suspicious website or server, which is how most malware gets caught, HollowGraph talks to its operators through calendar events. Attackers create entries with strange dates, some set decades in the future, around the year 2050. These fake appointments are never meant to be seen by a real person. They are containers for hidden text and file attachments that carry instructions and stolen data back and forth.
Because this traffic flows through Microsoft's own systems using the Microsoft Graph API, the connections look like normal, everyday use of Microsoft 365. That makes it much harder for security tools to flag as suspicious, since the malware is not reaching out to an unknown or blacklisted server. It is just using a feature that millions of businesses rely on every day for scheduling meetings.
How the Calendar Becomes a Secret Mailbox
Once attackers gain access to a Microsoft 365 mailbox, they can plant HollowGraph as part of a larger set of tools built for long-term spying rather than quick theft. The calendar becomes what researchers describe as a two-way drop box. Commands get placed into calendar events by the attacker. The infected system checks the calendar, reads the hidden instructions, carries them out, and then places stolen data back into another event as an attachment.
This back-and-forth means the attacker never has to directly connect to the victim's computer. All communication passes through Microsoft's servers, disguised as routine calendar activity. Since the dates on these events are set far in the future, they are unlikely to show up when someone scrolls through their actual schedule, and an IT team scanning for unusual activity may not think to check calendar entries at all.
This approach fits a pattern seen more often in recent years, where attackers try to blend their activity into tools that businesses already trust and use constantly. Email, cloud storage, and now calendars have all been used as cover for moving stolen information or attacker instructions without raising alarms.
A Second, Unrelated Campaign Targets Developers
Separately, researchers have also uncovered a large-scale scheme involving nearly 7,600 fake GitHub repositories, the online spaces developers use to store and share code. More than 800 of these fake repositories were built to look like artificial intelligence tools or components related to AI systems, a category that has drawn heavy interest from developers experimenting with new technology.
The campaign, tracked under the name FakeGit, relies on copied projects, fake developer profiles, and convincing project descriptions to trick people into downloading what looks like legitimate code. Instead, victims end up installing a malware loader known as SmartLoader, which can then be used to install additional malicious programs on the victim's computer.
This campaign shows how attackers are increasingly targeting developers and technical workers directly, betting that curiosity about new AI tools will lead people to download and run code without carefully checking where it came from.
Why This Matters for Everyday Users
Neither of these stories targets home users directly in the way a typical phishing email or scam text might. HollowGraph is aimed at organizations with valuable data worth stealing over a long period of time, and FakeGit is aimed at software developers. But both stories point to a bigger trend worth understanding: attackers are getting better at hiding their activity inside tools people already trust and use without much suspicion, whether that is a calendar app or a code-sharing website.
For regular internet users, the practical lesson is less about these specific tools and more about the mindset behind them. Attackers count on people assuming that familiar, everyday features are automatically safe.
What You Should Do
- If you use Microsoft 365 for work, report any calendar invites you did not create or expect, even ones that seem harmless or oddly dated.
- Turn on multi factor authentication for any email or cloud account, since attackers need account access before they can plant tools like HollowGraph.
- If you write or download code, verify the source of any GitHub repository, checking the developer's history and reviews rather than trusting a polished description alone.
- Avoid downloading and running unfamiliar code or scripts, especially ones promoted as shortcuts for trendy AI tools.
- Keep security software updated on work and personal devices, since updated tools are more likely to catch newer techniques as they become known.
