Cyber: First Malicious Outlook Add-in Found Stealing 4,000+ Microsoft...
Cybersecurity researchers have discovered what they said is the first known malicious Microsoft Outlook add-in detected in the wild.
In this unusual supply chain attack detailed by Koi Security, an unknown attacker claimed the domain associated with a now-abandoned legitimate add-in to serve a fake Microsoft login page, stealing over 4,000 credentials in the process. The activity has been codenamed AgreeToSteal by the cybersecurity company.
The Outlook add-in in question is AgreeTo, which is advertised by its developer as a way for users to connect different calendars in a single place and share their availability through email. The add-in was last updated in December 2022.
Idan Dardikman, co-founder and CTO of Koi, told The Hacker News that the incident represents a broadening of supply chain attack vectors.
"This is the same class of attack we've seen in browser extensions, npm packages, and IDE plugins: a trusted distribution channel where the content can change after approval," Dardikman said. "What makes Office add-ins particularly concerning is the combination of factors: they run inside Outlook, where users handle their most sensitive communications, they can request permissions to read and modify emails, and they're distributed through Microsoft's own store, which carries implicit trust."
"The AgreeTo case adds another dimension: the original developer did nothing wrong. They built a legitimate product and moved on. The attack exploited the gap between when a developer abandons a project and when the platform notices. Every marketplace that hosts remote dynamic dependencies is susceptible to this."
At its core, the attack exploits how Office add-ins work and the lack of periodic content monitoring of add-ins published to the Marketplace. According to Microsoft's documentation, add-in developers are required to create an account and submit their solution to the Partner Center, following which it is subjected to an approval process.
What's more, Office add-ins make use of a manifest file that declares a URL, the contents of which are fetched and served in real-time from the developer's server every time it's opened within an iframe element inside the application. However, there is nothing stopping a bad actor from taking control of an expired domain.
In the case of AgreeTo, the manifest file pointed to a URL hosted on Vercel ("outlook-one.vercel[.]app"), which became claimable after the developer's Vercel deployment was deleted due to it esse
Source: The Hacker News
