Home / Technology / Hackers Steal 4,000+ Microsoft Accounts Via Add-in
Hackers Steal 4,000+ Microsoft Accounts Via Add-in
12 Feb
Summary
- Abandoned Outlook add-in turned into a sophisticated phishing kit.
- Over 4,000 Microsoft accounts and financial data were stolen.
- This marks the first malware on the official Microsoft Marketplace.
A legitimate, but since abandoned, Microsoft Outlook add-in known as AgreeTo has been repurposed by malicious actors into a sophisticated phishing kit. This add-in, which initially served as a meeting scheduler, had a significant user base before its URL was exploited. Threat actors used this exploit to deploy a fake Microsoft login page, tricking users into divulging their credentials.
Security researchers identified that more than 4,000 Microsoft accounts were stolen through this scheme. Alarmingly, the attackers also gained access to credit card numbers and banking security questions, providing ample information for fraudulent financial activities. The campaign was active, with attackers testing compromised credentials for further exploitation.
Microsoft has since removed the add-in from its official store. This marks a significant security breach, being the first instance of malware appearing on the Microsoft Marketplace and the first malicious Outlook add-in discovered actively in circulation. Users are strongly advised to remove the add-in immediately, reset their passwords, and monitor their financial statements for any suspicious transactions.
