Inside Job: Abandoned Outlook Add-in “AgreeTo” Steals 4,000 Credentials

Researchers at Koi Security discovered that the Outlook add-in 'AgreeTo' was hijacked after its developer let the Vercel-hosted URL expire; attackers claimed the URL, deployed a phishing kit served inside Outlook’s sidebar, and collected over 4,000 Microsoft account credentials, credit card numbers, and security answers. Because the phishing content was hosted on a legitimate domain and loaded within Outlook (with ReadWriteItem permissions), it bypassed usual gateways and endpoint protections and could read or modify users' emails, demonstrating a high-impact abuse of remote-hosted Office add-ins.