Outlook add-in goes rogue and steals 4,000 credentials and payment data

Malwarebytes reports that an abandoned Outlook add-in called AgreeTo was hijacked after its Vercel backend URL expired; an attacker claimed the subdomain and replaced the add-in content with a four-page phishing kit that harvested Microsoft credentials and payment/banking data, exfiltrating entries via a Telegram bot. Researchers recovered over 4,000 stolen Microsoft account credentials and evidence the operator runs at least a dozen multi-brand phishing kits, making this an active and organized credential-theft campaign.