First Malicious Outlook Add-In Found Stealing 4,000+ Microsoft Credentials

Researchers from Koi Security identified a supply-chain phishing campaign dubbed "AgreeToSteal" in which an attacker took control of an abandoned Outlook add-in's hosting domain and served a fake Microsoft login page, stealing over 4,000 credentials; the add-in's ReadWriteItem permissions also created risk of mailbox exfiltration and broader compromise, prompting recommendations for periodic rescanning, domain ownership verification, and re-review of changed content in the Microsoft Marketplace.