The targeted espionage tool hides commands and stolen files inside calendar events while using legitimate Microsoft cloud traffic to evade detection.