Back Thehackernews

First Malicious Outlook Add-In Found Stealing 4,000+ Microsoft Credentials

Thehackernews •[email protected] (The Hacker News) • February 11, 2026

Join Wiz experts to see how AI and context-aware forensics make cloud investigations faster, clearer, and more reliable.

Quantum computers could soon break today’s encryption—join Zscaler’s webinar to learn how post-quantum cryptography keeps your data safe for the future.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Weaponized Microsoft Outlook Add-ins Exploit User Credentials A dormant Microsoft Outlook add-in has been weaponized, leading to the theft of thousands of login credentials and credit card numbers. This incident marks the first known malicious Office add-in discovered in the wild, revealing a critical flaw in Microsoft's distribution of third-party tools. Additionally, a new attack technique called 'Exfil Out&Look' has been identified, allowing threat actors to exfiltrate sensitive email data without leaving forensic traces. 9 sources 40

Extracted Entities

First Malicious Outlook Add-In Found Stealing 4,000+ Microsoft Credentials

The full story

Extracted Entities

Attack Types (2)

Companies (1)

MITRE ATT&CK (1)

Platforms (1)