Loading story…
A legitimate Microsoft Outlook meeting-scheduling add-in, AgreeTo, was hijacked after its developer abandoned the project and the add-in’s backend Vercel URL (outlook-one.vercel.app) expired and was later re-registered by a threat actor. Because Office add-ins are effectively signed XML manifests that load a developer-controlled URL in an iframe, Microsoft’s review/signing process validated the manifest at submission time but did not continuously verify what the referenced URL served afterward. The attacker leveraged the add-in’s previously approved ReadWriteItem permissions (appropriate for scheduling, but powerful if abused) to present a convincing in-client phishing experience inside Outlook’s sidebar.
Researchers reported the attacker deployed a multi-step phishing kit (fake Microsoft sign-in, credential/password capture, exfiltration, and redirect to the legitimate login.microsoftonline.com) and exfiltrated data via a Telegram bot/channel, including 4,000+ Microsoft account credentials as well as credit card numbers and banking security answers. The Chrome extension associated with the project had already been removed earlier after becoming defunct, but the Outlook add-in remained listed in the Office Add-in Store until it was discovered and subsequently removed; investigators also observed the actor actively testing stolen credentials during analysis.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Microsoft removed the malicious AgreeTo add-in from the Microsoft Office Add-in Store on the day the reporting was published. The removal followed disclosure that the add-in had been hijacked to serve phishing content and abuse its existing permissions.
Koi Security published its findings on the malicious add-in, described it as the first known malicious Outlook add-in seen in the wild, and said it notified affected victims where possible. The researchers also submitted abuse and takedown reports to Microsoft, Vercel, and Telegram.
The hijacked add-in displayed a fake Microsoft sign-in page inside Outlook's trusted sidebar, harvested credentials, and exfiltrated them through Telegram along with some payment and banking data. Investigators later recovered evidence of more than 4,000 victim accounts and linked the activity to a broader multi-brand phishing operation.
After the developer abandoned the add-in and its Vercel-hosted backend URL lapsed, a threat actor re-registered or reclaimed the orphaned Vercel location. The attacker replaced the legitimate content with a phishing kit while the approved add-in remained in Microsoft's store.
The legitimate AgreeTo meeting-scheduling Outlook add-in was listed in the Microsoft Office Add-in Store in December 2022. Its manifest was approved by Microsoft and pointed Outlook to load remote content from developer-controlled infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcemalwarebytes.com
Open sourcebleepingcomputer.com
Open sourcekoi.ai
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported the first known malicious Microsoft Outlook add-in, dubbed **AgreeToSteal**, being used to harvest more than 4,000 Microsoft account credentials. The add-in abused Outlook’s extensibility model to present credential-stealing prompts inside a trusted email client environment, giving attackers a convincing way to capture usernames and passwords tied to Microsoft services. The campaign highlights a new phishing and account-theft vector that moves beyond malicious documents and browser-based lures into enterprise productivity software itself. Security reporting said the add-in was discovered in the wild and linked to large-scale credential theft, underscoring the need for organizations to scrutinize Outlook add-ins, restrict unauthorized extensions, and monitor Microsoft account activity for signs of compromise.
Jul 12, 2026
Varonis Threat Labs reported an attack technique dubbed **Exfil Out&Look** that abuses *Microsoft 365 Outlook* add-ins—particularly in **Outlook Web Access (OWA)**—to exfiltrate sensitive email content with little to no forensic visibility. The method does not rely on a traditional software vulnerability; instead, it weaponizes legitimate add-in capabilities (manifest-driven HTML/JS apps) to intercept outbound messages via the `OnMessageSend` event and transmit email data (e.g., subject, body, recipients) to attacker-controlled infrastructure, potentially using only minimal permissions such as `ReadWriteItem` that may avoid higher-friction consent prompts. A key risk highlighted is a logging and accountability gap: **OWA may not generate Unified Audit Log entries for add-in installation or execution**, enabling persistence and “zero-trace” operation in environments that depend on Microsoft 365 audit telemetry for detection and investigations. Varonis stated it reported the issue to Microsoft via **MSRC** (Sept. 30, 2025) and that Microsoft categorized it as a low-severity product issue with no immediate fix planned; as a result, defenders may need to focus on governance and control of add-ins (e.g., restricting add-in installation sources and permissions) rather than expecting a near-term patch.
Jun 29, 2026
Attackers are abusing Outlook calendar invites in an active **CalPhishing** campaign to hijack Microsoft 365 accounts by delivering malicious `.ics` files that automatically place tentative meetings on victims’ calendars. Researchers at Fortra Intelligence and Research Experts (FIRE) said the invites impersonate urgent administrative notices such as Microsoft 365 domain renewal warnings and digital-signature invoice requests, with manipulated `SUMMARY`, `LOCATION`, and `DESCRIPTION` fields directing users to fake Microsoft 365, GoDaddy, or DocuSign pages. Because the calendar entry can remain visible even if the original email is deleted or sent to junk, the lure continues to generate trusted reminders and increases the chance of user interaction. The campaign uses HTML landing pages and redirect chains through **Cloudflare** to reduce detection, and researchers believe the operators are likely using the **EvilTokens** phishing kit sold on Telegram to automate the attacks. FIRE warned that the activity appears to incorporate **ConsentFix**-style device code phishing to steal session tokens rather than just passwords, allowing attackers to bypass **MFA** and maintain access to compromised accounts. The combination of trusted calendar workflows, persistent invites, and likely AI-assisted automation makes the technique a significant threat to enterprise account security and data privacy.
Jun 29, 2026