{"id":10603,"date":"2026-02-12T10:03:52","date_gmt":"2026-02-12T10:03:52","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/02\/12\/microsoft-outlook-add-in-stolen-4000-microsoft-account-credentials-and-credit-card-numbers\/"},"modified":"2026-02-12T10:03:52","modified_gmt":"2026-02-12T10:03:52","slug":"microsoft-outlook-add-in-stolen-4000-microsoft-account-credentials-and-credit-card-numbers","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/02\/12\/microsoft-outlook-add-in-stolen-4000-microsoft-account-credentials-and-credit-card-numbers\/","title":{"rendered":"Microsoft Outlook Add-in Stolen 4,000 Microsoft account Credentials and Credit Card Numbers"},"content":{"rendered":"

Microsoft Outlook Add-in Stolen 4,000 Microsoft account Credentials and Credit Card Numbers
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Security researchers have identified the first documented instance of a malicious Microsoft Outlook add-in being used against users in real-world scenarios.<\/p>\n

A compromised meeting scheduler named\u00a0AgreeTo\u00a0was used to steal over 4,000 Microsoft account credentials<\/a>, credit card numbers, and answers to banking security questions.<\/p>\n

AgreeTo began as a legitimate open-source project published to the Microsoft Office Add-in Store<\/a> in December 2022.<\/p>\n

\"Koidex
Koidex report for AgreeTo add-in (Source: Koi AI)<\/em><\/figcaption><\/figure>\n

It was a functional meeting tool with positive reviews. However, the developer eventually abandoned the project and deleted the associated Vercel deployment.<\/p>\n

This left the add-in\u2019s hosting URL (outlook-one.vercel.app) orphaned and available for registration.\u200b An attacker claimed the available URL and deployed a phishing kit.<\/p>\n

\"AgreeTo
AgreeTo page on the Office Add-ins marketplace (Source: Koi AI)<\/em><\/figcaption><\/figure>\n

Because the add-in was never removed from Microsoft\u2019s store, the attacker\u2019s phishing page<\/a> was served directly in the trusted Outlook sidebar to anyone who still had the add-in installed or had downloaded it fresh.\u200b<\/p>\n

The Technical Flaw: Remote Dynamic Dependencies<\/strong><\/h2>\n

The attack exploited the architecture of Office add-ins. Unlike traditional installed software, add-ins are \u201cremote dynamic dependencies,\u201d essentially XML manifests that load a URL in an iframe.\u200b<\/p>\n

\n\n\n\n\n\n\n\n
Stage<\/strong><\/th>\nDescription<\/strong><\/th>\n<\/tr>\n<\/thead>\n
The Gap<\/strong><\/td>\nMicrosoft reviews the manifest only during the initial submission (2022 in this case).<\/td>\n<\/tr>\n
The Exploit<\/strong><\/td>\nMicrosoft does not continuously verify the live content hosted at the approved URL.<\/td>\n<\/tr>\n
The Result<\/strong><\/td>\nThe attacker swapped the scheduling tool with a fake Microsoft login page without triggering a new security review.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

When victims opened AgreeTo, they were prompted to log in. A script harvested their credentials and IP addresses, sending the data to the attacker via a Telegram bot.<\/a><\/p>\n

\n
\"Add-in
Add-in Displays Fake Login (Source: Koi AI)<\/em><\/figcaption><\/figure>\n<\/div>\n

\u200bKoi Security discovered the campaign<\/a> after identifying the attacker\u2019s poorly secured exfiltration channel.<\/p>\n

They recovered the full dataset of 4,000 victims, which included banking details and security answers targeting Canadian institutions.<\/p>\n

The add-in had \u201cReadWriteItem\u201d permissions, which technically allowed the attacker to read and modify users\u2019 emails. However, the attack primarily focused on credential harvesting.\u200b<\/p>\n

Microsoft has removed the add-in following the report. This incident highlights a critical\u00a0supply chain risk<\/a>: trusted software can silently become<\/span> malicious years after approval if its infrastructure is abandoned.<\/p>\n

Follow us on Google News<\/a>, LinkedIn<\/a>, and X<\/a> for daily cybersecurity updates. Contact us<\/a> to feature your stories.<\/strong><\/p>\n

The post Microsoft Outlook Add-in Stolen 4,000 Microsoft account Credentials and Credit Card Numbers<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Abinaya
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Microsoft Outlook Add-in Stolen 4,000 Microsoft account Credentials and Credit Card Numbers Security researchers have identified the first documented instance of a malicious Microsoft Outlook add-in being used against users in real-world scenarios. A compromised meeting scheduler named\u00a0AgreeTo\u00a0was used to steal over 4,000 Microsoft account credentials, credit card numbers, and answers to banking security questions. […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1636,129,63,158],"tags":[130],"class_list":["post-10603","post","type-post","status-publish","format-standard","hentry","category-cyber-attack-news","category-cyber-security","category-cyber-security-news","category-microsoft","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/10603"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=10603"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/10603\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=10603"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=10603"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=10603"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}