Back Computerworld

'Dead' Outlook add-in hijacked to phish 4000 Microsoft Office Store users

Computerworld • February 12, 2026

Microsoft OutlookEmail ClientsProductivity SoftwarePhishing Social Engineering CybercrimeSecurity ... Microsoft OutlookPhishing Social Engineering . Image.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Weaponized Microsoft Outlook Add-ins Exploit User Credentials A dormant Microsoft Outlook add-in has been weaponized, leading to the theft of thousands of login credentials and credit card numbers. This incident marks the first known malicious Office add-in discovered in the wild, revealing a critical flaw in Microsoft's distribution of third-party tools. Additionally, a new attack technique called 'Exfil Out&Look' has been identified, allowing threat actors to exfiltrate sensitive email data without leaving forensic traces. 9 sources 40

Extracted Entities

'Dead' Outlook add-in hijacked to phish 4000 Microsoft Office Store users

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (1)