Loading story…
Varonis Threat Labs reported an attack technique dubbed Exfil Out&Look that abuses Microsoft 365 Outlook add-ins—particularly in Outlook Web Access (OWA)—to exfiltrate sensitive email content with little to no forensic visibility. The method does not rely on a traditional software vulnerability; instead, it weaponizes legitimate add-in capabilities (manifest-driven HTML/JS apps) to intercept outbound messages via the OnMessageSend event and transmit email data (e.g., subject, body, recipients) to attacker-controlled infrastructure, potentially using only minimal permissions such as ReadWriteItem that may avoid higher-friction consent prompts.
A key risk highlighted is a logging and accountability gap: OWA may not generate Unified Audit Log entries for add-in installation or execution, enabling persistence and “zero-trace” operation in environments that depend on Microsoft 365 audit telemetry for detection and investigations. Varonis stated it reported the issue to Microsoft via MSRC (Sept. 30, 2025) and that Microsoft categorized it as a low-severity product issue with no immediate fix planned; as a result, defenders may need to focus on governance and control of add-ins (e.g., restricting add-in installation sources and permissions) rather than expecting a near-term patch.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Varonis publicly disclosed the 'Exfil Out&Look' technique, showing that a malicious Outlook add-in can hook message-send events, capture outbound email data, and transmit it to an external server with minimal permissions and little to no forensic visibility. The research highlighted that OWA-based add-in installs lack corresponding Unified Audit Log entries, while desktop Outlook leaves only a local Windows Event Viewer artifact.
Varonis Threat Labs reported to Microsoft's Security Response Center that Outlook add-ins installed via Outlook Web Access could be abused for stealthy email exfiltration because installation and execution were not captured in Microsoft 365 Unified Audit Logs. Microsoft reportedly classified the issue as a low-severity product bug or suggestion and did not plan an immediate fix.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcevaronis.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released fixes for **CVE-2026-42897**, a high-severity spoofing flaw in **Exchange Server** that was actively exploited in attacks and could lead to arbitrary JavaScript execution through cross-site scripting in **Outlook Web Access (OWA)**. The vulnerability affects **Exchange Server 2016**, **Exchange Server 2019**, and **Exchange Server Subscription Edition**, and can be triggered remotely without privileges by sending a specially crafted email that executes when opened in OWA under certain user-interaction conditions. Microsoft classifies the issue as a spoofing vulnerability, consistent with prior MSHTML- and web-rendering-related spoofing flaws such as **CVE-2024-43461**. Before full patches were released, Microsoft deployed an automatic temporary mitigation through the **Exchange Emergency Mitigation Service** in mid-May and later shipped permanent fixes in its June 2026 security updates, while advising administrators to keep mitigations enabled and patch immediately. **CISA** added the bug to its **Known Exploited Vulnerabilities** catalog on May 15 and ordered U.S. federal agencies to remediate affected systems by May 29, underscoring continued attacker focus on Exchange, which has seen numerous exploited flaws over the past five years, including several linked to ransomware activity.
Jun 29, 2026
Researchers reported the first known malicious Microsoft Outlook add-in, dubbed **AgreeToSteal**, being used to harvest more than 4,000 Microsoft account credentials. The add-in abused Outlook’s extensibility model to present credential-stealing prompts inside a trusted email client environment, giving attackers a convincing way to capture usernames and passwords tied to Microsoft services. The campaign highlights a new phishing and account-theft vector that moves beyond malicious documents and browser-based lures into enterprise productivity software itself. Security reporting said the add-in was discovered in the wild and linked to large-scale credential theft, underscoring the need for organizations to scrutinize Outlook add-ins, restrict unauthorized extensions, and monitor Microsoft account activity for signs of compromise.
Jul 12, 2026
A legitimate Microsoft Outlook meeting-scheduling add-in, **AgreeTo**, was hijacked after its developer abandoned the project and the add-in’s backend **Vercel** URL (`outlook-one.vercel.app`) expired and was later re-registered by a threat actor. Because Office add-ins are effectively **signed XML manifests** that load a developer-controlled URL in an iframe, Microsoft’s review/signing process validated the manifest at submission time but did not continuously verify what the referenced URL served afterward. The attacker leveraged the add-in’s previously approved **ReadWriteItem** permissions (appropriate for scheduling, but powerful if abused) to present a convincing in-client phishing experience inside Outlook’s sidebar. Researchers reported the attacker deployed a multi-step phishing kit (fake Microsoft sign-in, credential/password capture, exfiltration, and redirect to the legitimate `login.microsoftonline.com`) and exfiltrated data via a **Telegram bot/channel**, including **4,000+ Microsoft account credentials** as well as **credit card numbers** and **banking security answers**. The Chrome extension associated with the project had already been removed earlier after becoming defunct, but the Outlook add-in remained listed in the Office Add-in Store until it was discovered and subsequently removed; investigators also observed the actor **actively testing stolen credentials** during analysis.
Jun 29, 2026