Malicious Outlook Add-In ‘AgreeToSteal’ Compromises 4,000 Accounts via Subdomain Takeover
Published
Key Takeaways
- Abandonware Exploitation: Threat actors executed a subdomain takeover of a legitimate but discontinued Outlook add-in by registering its previously deleted hosting subdomain.
- Extensive Compromise: The operation resulted in the exfiltration of more than 4,000 accounts via a fraudulent Microsoft authentication interface deployed within the Outlook client environment.
- Architectural Vulnerability: This incident demonstrates a fundamental security gap in Microsoft's add-in ecosystem, where validated manifests reference external URLs that remain susceptible to modification without subsequent security validation.
The first confirmed deployment of a malicious Outlook add-in in production environments, designated "AgreeToSteal," exploited a legitimate calendar management application called "AgreeTo," which had been discontinued by its developer, and stole more than 4,000 credential sets, payment card data, and banking information.
Following the deletion of the developer's Vercel deployment infrastructure, the associated subdomain (outlook-one.vercel.app) became available for external registration, and malicious actors claimed it, replacing the original scheduling functionality with a credential-harvesting framework.
Microsoft Office Add-In Security Architecture Deficiencies
Microsoft's infrastructure continued to distribute the original, signed manifest referencing this URL, enabling the AgreeToSteal phishing operation to execute via authenticated channels within the Outlook interface.
Upon add-in activation, targets encountered a phishing page displaying a counterfeit Microsoft authentication form instead of the expected scheduling interface, and exfiltrated data via Telegram.
The campaign, documented by Koi cybersecurity analysts, has facilitated the compromise of over 4,000 Microsoft account credentials, credit card numbers, and banking security answers.
Microsoft Office add-ins operate as externally hosted dynamic components, and the company conducts security assessments exclusively during initial manifest submission.
Cybersecurity Implications for Email Platform Infrastructure
The 'AgreeToSteal' campaign validates that point-in-time security assessments prove insufficient. Researchers highlight that this is a professional, multi-brand phishing operation, as the same attacker operates at least 12 distinct phishing kits, each impersonating a different brand, including Canadian ISPs, banks, and webmail providers.
“The stolen data included not just email credentials but credit card numbers, CVVs, PINs, and banking security answers used to intercept Interac e-Transfer payments.”
This month, a Notepad++ hijacking incident deploying a backdoor was linked to a Lotus Blossom campaign. In July 2025, aviation executives were targeted by a phishing scam leveraging fake Microsoft 365 login pages.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular