🚨 Malicious Outlook Add-In Steals 4,000+ Passwords --And Nobody Noticed

An abandoned Outlook add-in got hijacked. Passwords and financial info walked right out the door.

Hey folks -- imagine you're sitting at your desk, checking email in Outlook like you do every single morning. ☕ A familiar-looking Microsoft login pops up, you type in your password, and boom. You just handed your credentials to a criminal. That's what happened to over 4,000 people thanks to the first-ever malicious Outlook add-in found in the wild. The kicker? They never even knew it happened. #CyberSecurity #OutlookSecurity

Alright folks, here's the deal. Security researchers at Koi Security just found something that should give every business owner the heebie-jeebies. The first-ever malicious Outlook add-in, sitting right there in the official Microsoft Marketplace. The place you're supposed to trust. #DataBreach

The attack was codenamed "AgreeToSteal". Yeah, it's as nasty as it sounds. Here's how it went down:

There was a legit Outlook add-in called "AgreeTo" that helped people with scheduling. Last updated in December 2022. Basically abandoned by 2023. The developers let their website domain expire. That's like leaving your front door wide open and going on a permanent vacation. 🏚️

Some hosers -- that's what I call these cybercriminals -- swooped in and claimed the expired domain. The add-in was still listed in the Microsoft Marketplace, still pointed to that domain. So the hosers now controlled what it did. Picture somebody abandoning a storefront and a con artist putting up their own shop with the same name. #PhishingAttack

Here's where it gets clever. And scary. Remember that scene in Star Wars where Obi-Wan says "These aren't the droids you're looking for"? That's what this attack did. It showed you something that looked completely normal, and your brain just went along with it. 🧠

When a victim opened the add-in inside Outlook, it showed a fake Microsoft login page. Looked perfect. Identical to the real thing. People typed in their real Microsoft usernames and passwords without a second thought.

Then the add-in redirected them to the actual Microsoft login page. So the victim logs in for real, everything works normally, and they have absolutely zero idea their credentials were just stolen. That's the "Aha!" moment right there, folks. The hosers were invisible. 👻

The stolen passwords got shipped out through the Telegram Bot API, a messaging app the criminals used as their own private delivery service. And because the add-in had "ReadWriteItem" permissions, it could also read and modify your emails. Let that sink in. These hosers could read your bank notifications. Your invoices. Your private messages. All of it. #IdentityTheft #PasswordSecurity

⚠️ Important: Microsoft removed the malicious Outlook add-in from the Marketplace on February 12, 2026. But if you installed AgreeTo before that date, it may still be active in your Outlook. Check your add-ins NOW.

Let me paint you a few pictures. Because this matters to you, not just some big corporation.

🏪 Scenario 1: The Small Law Office
Say you're a small law firm in Hartford. Five employees. Your office manager installed AgreeTo back in 2022 to help schedule client meetings. Nobody thought about it again. Fast forward to 2026, and the hosers now have your Microsoft credentials. They can read emails about cases, access client financial documents, send emails pretending to be you. One fake invoice to a client? That's a $50,000 problem and a ruined reputation. Straight out of a Rockford Files episode, except it's your real life. #SmallBusinessSecurity

🏥 Scenario 2: The Doctor's Office
A medical practice in Boston uses Outlook for appointment coordination. A staffer installed the add-in years ago. Now the criminals can get into the doctor's email, which might include patient names, insurance info, billing details. That's a HIPAA violation waiting to happen. The fines alone could close a small practice for good. Yikes. 😬

🏗️ Scenario 3: The Construction Company
A general contractor in Providence uses Outlook for everything. Bids. Contracts. Payroll info. The compromised add-in gives hosers access to read those bid emails. They could undercut your pricing, redirect payments, or modify contract emails before you even see them. Remember, this add-in had ReadWriteItem permissions -- it could change your emails without you knowing. Like having a mole in your office, except this one's invisible. Think Three Days of the Condor, but with your email. #BusinessEmail

Folks, this is a first. We've never seen a malicious Outlook add-in attack like this before. Sure, phishing emails and sketchy downloads have been around for years. But this one hits different.

It came from the official Microsoft Marketplace. A place people trust. The original add-in was completely legitimate when first published. The fake login page appeared inside Outlook itself, not in a browser where you might notice a weird URL. And victims got redirected to the real login afterward, so nothing seemed wrong.

That's a whole new kind of attack. I gotta be honest, it's got me more worried than that time the shark showed up in Jaws. We're gonna need a bigger firewall. 🦈 #CyberThreats #MicrosoftSecurity

Here's what really keeps me up at night. This malicious Outlook add-in attack worked because of abandoned software. A developer stopped maintaining their product, let their domain expire, and criminals moved right in. Like when a business closes down and squatters take over the building. Except this building had a direct line into thousands of people's email.

Now think about how many apps and plugins you've installed over the years and forgotten about. Your browser extensions. Your phone apps. Your WordPress plugins. Every single one of those is a potential door into your digital life. And nobody's watching that door. As Sergeant Esterhaus from Hill Street Blues used to say: "Let's be careful out there." 👮 #AbandonedSoftware #CyberAwareness

📬 Don't Get Caught Off Guard

Threats like this malicious Outlook add-in pop up all the time now. I break down the latest cybersecurity news every week in plain English. No geek-speak, no fear-mongering. Just the stuff you need to know to keep your business safe.

Join thousands of business owners who take security seriously at CraigPeterson.com

Source: The Hacker News --First Malicious Outlook Add-In Found (source)