Malicious Outlook Add-in Breaches 4,000 Microsoft Accounts Through Store Exploit

Over 4,000 Microsoft users fell victim to AgreeToSteal, the first documented malicious Outlook add-in distributed through the official store, after cybercriminals hijacked an abandoned calendar-sharing tool. The attackers claimed the orphaned domain of AgreeTo in December 2022, transforming it into a sophisticated phishing operation that harvested credentials via fake Microsoft login pages. Data exfiltrated through Telegram included passwords, credit card details, and banking information. The incident exposes critical gaps in Microsoft’s verification architecture for developer-controlled servers, where initial manifest approval doesn’t guarantee ongoing content integrity—a vulnerability affecting countless third-party integrations.

A seemingly harmless Outlook add-in turned into a credential-harvesting nightmare after cybercriminals hijacked an abandoned project and weaponised it to steal login details from over 4,000 Microsoft account holders.

The add-in, originally called AgreeTo, was designed to help users share calendar availability through email—a legitimate productivity tool that earned a respectable 4.71-star rating in the Microsoft Store. But when its developer abandoned the project in December 2022, they left behind an orphaned URL hosted on Vercel. That oversight became a golden opportunity for threat actors who claimed the domain and transformed the benign tool into what Koi Security researchers now call AgreeToSteal, marking the first known malicious Outlook add-in detected in the wild.

When developers abandon projects without securing their infrastructure, orphaned domains become weapons in the hands of cybercriminals.

Here’s where Microsoft’s architecture reveals a concerning blind spot. Office add-ins load content from developer-controlled servers, and the company only reviews and signs the initial manifest during approval. Once listed in the Store, there’s no ongoing verification of what those servers actually deliver to users. It’s like inspecting a food truck’s menu but never checking what’s cooking in the back. This trust-based model allowed attackers to deploy a sophisticated phishing kit without triggering any alarms.

When unsuspecting users activated the add-in, a convincing fake Microsoft sign-in page materialised in their Outlook sidebar. Credentials were immediately exfiltrated through a Telegram bot API—no elaborate command-and-control infrastructure needed. Victims were then redirected to Microsoft’s legitimate login page, a clever sleight-of-hand designed to prevent suspicion. The harvested data went far beyond simple usernames and passwords, encompassing credit card numbers, CVVs, PINs, and even banking security answers for Interac e-Transfer payments. Researchers discovered attackers were actively testing stolen credentials during their investigation.

The attacker profile suggests this wasn’t an isolated experiment. The operator runs approximately a dozen additional phishing kits targeting banks, internet service providers, and webmail services, indicating a professional credential theft operation exploiting supply chain vulnerabilities. This attack vector mirrors compromises seen in browser extensions and npm packages—digital infrastructure we’ve learned to trust without questioning.

Microsoft removed the malicious add-in after Koi’s discovery, but the incident exposes systemic vulnerabilities in how the company manages third-party integrations. The AgreeTo add-in retained ReadWriteItem permissions theoretically capable of accessing and modifying emails, though researchers found no evidence of such abuse. Still, the potential was there. The add-in had been available since December 2022, giving the threat actor a substantial window of opportunity once they seized control of the abandoned infrastructure. The incident demonstrates how attackers exploited the gap between developer abandonment and Microsoft’s eventual detection to compromise thousands of accounts.

For the thousands affected, the damage extends beyond immediate credential theft. Security experts recommend changing passwords immediately, enabling multi-factor authentication, reviewing account activity for unauthorised access, notifying contacts about potential phishing from compromised accounts, and checking for suspicious email forwarding rules.

This breach highlights an uncomfortable reality: trusted distribution channels can become vectors for sophisticated attacks when oversight ends at the approval gate. As supply chain compromises grow more inventive, continuous content monitoring isn’t optional—it’s critical infrastructure hygiene.

Final Thoughts

The breach highlights a concerning gap in Microsoft’s app verification process—one that trusted distribution channels can’t always guarantee safety. Users should audit their installed add-ins immediately and activate multi-factor authentication across all accounts. Microsoft has removed the malicious tool, but the damage reveals how easily legitimate storefronts can become attack vectors. Until platforms tighten pre-publication security reviews, the responsibility for vigilance falls squarely on users themselves.