First Malicious Outlook Add-In Found Stealing 4,000+ Microsoft Credentials
Source The Hacker News
Rated by Threat Radar
Data as of 18 Feb 2026, 15:28 UTC
What to do
AI-suggested
European organizations should audit installed Outlook add-ins and remove any that are abandoned or from untrusted sources. Employ endpoint detection solutions capable of monitoring unusual add-in behavior, especially those with elevated permissions like ReadWriteItem. Implement multi-factor authentication (MFA) for Microsoft accounts to reduce the impact of credential theft. Monitor network traffic for suspicious connections to known malicious domains or unusual data exfiltration patterns. Advocate for Microsoft to enhance its marketplace security by enforcing domain ownership verification, continuous content scanning of add-in URLs, and automatic delisting of inactive or abandoned add-ins. Organizations should also educate users about phishing risks associated with add-ins and encourage reporting of suspicious login prompts. Deploy email security gateways with advanced phishing detection capabilities. Finally, maintain an inventory of all third-party add-ins and integrate this into vulnerability management and incident response processes to rapidly address emerging threats.
Description
Cybersecurity researchers have discovered what they said is the first known malicious Microsoft Outlook add-in detected in the wild. In this unusual supply chain attack detailed by Koi Security, an unknown attacker claimed the domain associated with a now-abandoned legitimate add-in to serve a fake Microsoft login page, stealing over 4,000 credentials in the process. The activity has been