TL;DR

['A malicious Outlook add-in was found stealing credentials from users; over 4,000 Microsoft accounts were compromised.', 'Attackers used a supply chain technique by compromising the domain for a legitimate add-in and served a fake login page.']

What happened

['Researchers discovered the first known malicious Microsoft Outlook add-in in the wild.', 'The attacker claimed a domain associated with a now-abandoned legitimate add-in to serve a fake Microsoft login page.', 'Over 4,000 credentials were stolen during this supply chain attack.']

Why it matters for ops

['This highlights risks associated with third-party software and extensions within enterprise environments.', 'Operators need to implement additional security measures to protect against such threats.']

Mitigation

  • Validate the integrity of third-party software and extensions before deployment
  • Implement multi-factor authentication (MFA) for all users

Action items

  • Review security policies regarding third-party add-ins and extensions
  • Educate employees on recognizing phishing attempts through login pages

Detection IOCs

  • Unexpected network requests to suspicious domains during login attempts
  • Multiple failed authentication attempts from a single IP address or user agent

Source link

https://thehackernews.com/2026/02/first-malicious-outlook-add-in-found.html