Outlook add-in goes rogue and steals 4,000 credentials and payment data

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Weaponized Microsoft Outlook Add-ins Exploit User Credentials A dormant Microsoft Outlook add-in has been weaponized, leading to the theft of thousands of login credentials and credit card numbers. This incident marks the first known malicious Office add-in discovered in the wild, revealing a critical flaw in Microsoft's distribution of third-party tools. Additionally, a new attack technique called 'Exfil Out&Look' has been identified, allowing threat actors to exfiltrate sensitive email data without leaving forensic traces. 9 sources 40