{"id":"agreeto-outlook-addin-hijack-phishing-feb-2026","category":"supply-chain","status":"closed","title":"Outlook's AgreeTo add-in hijacked to show fake Microsoft sign-in pages and steal 4,000+ logins","tldr":"An abandoned Outlook add-in, AgreeTo, was taken over and showed fake Microsoft logins inside Outlook; 4,000+ credential sets were stolen. Microsoft removed it. If you used it, uninstall it, change your Microsoft password and check bank and card statements.","summary":"AgreeTo was a meeting-scheduling add-in for Outlook, listed in Microsoft's Office Add-in Store since December 2022. Its developer abandoned it, but the listing stayed live and still loaded its screen from a Vercel web address. An attacker claimed that unused address and put up a phishing kit. Because Microsoft reviewed the add-in once and does not re-check what the address serves later, Outlook began showing a fake Microsoft sign-in page in the sidebar. Typed passwords went to an attacker-controlled Telegram bot, and victims were then sent on to the real Microsoft login. Koi Security reached the attacker's poorly secured channel and recovered more than 4,000 sets of Microsoft credentials, plus credit card numbers, CVVs, PINs and banking security answers. The same operator reportedly runs at least a dozen other phishing kits. The add-in kept permission to read and modify email, but no such misuse was confirmed. Microsoft removed the add-in and said it had taken further steps to protect affected customers. No later development was found as of 3 November 2026.","action":"If you installed AgreeTo in Outlook, remove it, change your Microsoft password (and any account where you reused it), and check recent sign-ins and mailbox rules for anything you didn't set up. Watch card and bank statements for several months and dispute anything unfamiliar.","product":"Microsoft Outlook (AgreeTo add-in from the Office Add-in Store)","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["microsoft","outlook","office-add-in","supply-chain","phishing","credential-theft","koi-security","abandoned-domain"],"affected":["AgreeTo Outlook add-in (any installed copy, in the Microsoft Office Add-in Store from December 2022 until removed)"],"fixed":[],"matches":[{"platform":"other","app":"AgreeTo (Outlook add-in)","bundle":"","fixed":""}],"sources":[{"kind":"news","title":"Microsoft Store Outlook add-in hijacked to steal 4,000 Microsoft accounts","url":"https://www.bleepingcomputer.com/news/security/microsoft-store-outlook-add-in-hijacked-to-steal-4-000-microsoft-accounts/","by":"BleepingComputer","date":"2026-02-11"},{"kind":"news","title":"Outlook add-in goes rogue and steals 4,000 credentials and payment data","url":"https://www.malwarebytes.com/blog/news/2026/02/outlook-add-in-goes-rogue-and-steals-4000-credentials-and-payment-data","by":"Malwarebytes","date":"2026-02-12"}],"started":"2026-02-11","closed":"2026-02-12","created":"2026-11-03T21:34:14.934Z","updated":"2026-11-03T21:34:14.934Z","cve_notes":[],"timeline":[{"at":"2026-02-12","added":"2026-11-03T21:32:34.430Z","kind":"other","text":"Malwarebytes detailed the campaign: four phishing pages, credentials sent to the attacker's Telegram bot, and payment data including card numbers, CVVs, PINs and bank security answers used to intercept Interac e-Transfers. It said the same operator runs at least 12 other phishing kits. Its article does not describe a specific Microsoft action.","url":"https://www.malwarebytes.com/blog/news/2026/02/outlook-add-in-goes-rogue-and-steals-4000-credentials-and-payment-data","by":"Malwarebytes","patch":null},{"at":"2026-02-11","added":"2026-11-03T21:32:34.430Z","kind":"other","text":"Microsoft removed the add-in from its store and said it had taken additional steps to protect potentially affected customers. It said it would keep improving how it detects this kind of behaviour. BleepingComputer's report was later updated on 14 February.","url":"https://www.bleepingcomputer.com/news/security/microsoft-store-outlook-add-in-hijacked-to-steal-4-000-microsoft-accounts/","by":"BleepingComputer","patch":"na"},{"at":"2026-02-11","added":"2026-11-03T21:32:34.430Z","kind":"disclosed","text":"Koi Security reported that AgreeTo, a meeting-scheduling add-in listed in Microsoft's Office Add-in Store since December 2022, had been taken over after its developer abandoned it. An attacker claimed the abandoned Vercel address the add-in loaded from and put a fake Microsoft sign-in page there. Koi recovered more than 4,000 sets of Microsoft credentials from the attacker's Telegram channel, along with card and banking details.","url":"https://www.bleepingcomputer.com/news/security/microsoft-store-outlook-add-in-hijacked-to-steal-4-000-microsoft-accounts/","by":"BleepingComputer","patch":null}],"url":"https://hard.fyi/live/agreeto-outlook-addin-hijack-phishing-feb-2026/","json":"https://hard.fyi/api/live?id=agreeto-outlook-addin-hijack-phishing-feb-2026"}