[hollowgraph]

July 30, 2026

• HOLLOWGRAPH backdoor turns Microsoft 365 calendars into a C2 channel, blending command traffic into legitimate Graph API activity. Picus Security · Threat Activity

in OpenAI's Rogue Agent Widens: Four More Companies Caught in the Blast Radius

July 21, 2026

• HOLLOWGRAPH turns compromised Microsoft 365 mailboxes into a command-and-control channel, using the Microsoft Graph API to pull operator tasks and exfiltrate stolen files as attachments on calendar events dated to the year 2050 — blending malicious traffic into legitimate M365 flows. Group-IB attributes the .NET NativeAOT DLL to the Cavern backdoor framework and a suspected Israel-linked actor; the two-command implant (get/send) exploits no vulnerabilities, relying entirely on trusted cloud infrastructure to evade network detection. Group-IB (via NCSC-FI), The Hacker News. · Threat Activity & Tradecraft

in Microsoft Graph Becomes a Spy's Dead Drop as WordPress "wp2shell" Exploitation Goes Live