Loading story…
Researchers reported the first known malicious Microsoft Outlook add-in, dubbed AgreeToSteal, being used to harvest more than 4,000 Microsoft account credentials. The add-in abused Outlook’s extensibility model to present credential-stealing prompts inside a trusted email client environment, giving attackers a convincing way to capture usernames and passwords tied to Microsoft services.
The campaign highlights a new phishing and account-theft vector that moves beyond malicious documents and browser-based lures into enterprise productivity software itself. Security reporting said the add-in was discovered in the wild and linked to large-scale credential theft, underscoring the need for organizations to scrutinize Outlook add-ins, restrict unauthorized extensions, and monitor Microsoft account activity for signs of compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Koi Security reported discovering AgreeToSteal, described as the first malicious Outlook add-in, which impersonated Adobe Acrobat and abused OAuth permissions to steal Microsoft credentials. The campaign was linked to more than 4,000 stolen credentials.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A legitimate Microsoft Outlook meeting-scheduling add-in, **AgreeTo**, was hijacked after its developer abandoned the project and the add-in’s backend **Vercel** URL (`outlook-one.vercel.app`) expired and was later re-registered by a threat actor. Because Office add-ins are effectively **signed XML manifests** that load a developer-controlled URL in an iframe, Microsoft’s review/signing process validated the manifest at submission time but did not continuously verify what the referenced URL served afterward. The attacker leveraged the add-in’s previously approved **ReadWriteItem** permissions (appropriate for scheduling, but powerful if abused) to present a convincing in-client phishing experience inside Outlook’s sidebar. Researchers reported the attacker deployed a multi-step phishing kit (fake Microsoft sign-in, credential/password capture, exfiltration, and redirect to the legitimate `login.microsoftonline.com`) and exfiltrated data via a **Telegram bot/channel**, including **4,000+ Microsoft account credentials** as well as **credit card numbers** and **banking security answers**. The Chrome extension associated with the project had already been removed earlier after becoming defunct, but the Outlook add-in remained listed in the Office Add-in Store until it was discovered and subsequently removed; investigators also observed the actor **actively testing stolen credentials** during analysis.
Jun 29, 2026
Varonis Threat Labs reported an attack technique dubbed **Exfil Out&Look** that abuses *Microsoft 365 Outlook* add-ins—particularly in **Outlook Web Access (OWA)**—to exfiltrate sensitive email content with little to no forensic visibility. The method does not rely on a traditional software vulnerability; instead, it weaponizes legitimate add-in capabilities (manifest-driven HTML/JS apps) to intercept outbound messages via the `OnMessageSend` event and transmit email data (e.g., subject, body, recipients) to attacker-controlled infrastructure, potentially using only minimal permissions such as `ReadWriteItem` that may avoid higher-friction consent prompts. A key risk highlighted is a logging and accountability gap: **OWA may not generate Unified Audit Log entries for add-in installation or execution**, enabling persistence and “zero-trace” operation in environments that depend on Microsoft 365 audit telemetry for detection and investigations. Varonis stated it reported the issue to Microsoft via **MSRC** (Sept. 30, 2025) and that Microsoft categorized it as a low-severity product issue with no immediate fix planned; as a result, defenders may need to focus on governance and control of add-ins (e.g., restricting add-in installation sources and permissions) rather than expecting a near-term patch.
Jun 29, 2026
Researchers reported multiple **malicious browser extension** campaigns abusing official add-on ecosystems to steal data and hijack accounts. One operation tracked as **GhostPoster** hid malicious logic inside seemingly benign PNG image files, a technique used to evade typical extension review and static checks; follow-on infrastructure analysis linked the activity to at least **17 additional extensions** using the same backend and tactics, with **~840,000 installs** and some extensions active for up to **five years**. The campaign reportedly started on **Microsoft Edge** and later expanded to **Chrome and Firefox**, emphasizing stealth and long-term persistence over rapid spread. Separately, Socket researchers identified **five malicious Chrome extensions** impersonating enterprise platforms (*Workday, NetSuite, SuccessFactors*) to enable **session hijacking and account takeover**. The extensions were described as working together to **steal authentication tokens/cookies**, **block incident response** by manipulating the DOM to interfere with security administration pages, and perform **cookie injection** to take over sessions; most were removed from the Chrome Web Store but remained available via third-party download sites. In response to the broader extension abuse, **Mozilla and Microsoft** removed identified add-ons from their marketplaces, but already-installed extensions remain a risk and require **manual removal**.
Jun 29, 2026