AgreeToSteal: The First Malicious Outlook Add-In Leads to 4,000 Stolen Credentials

[Khushal]

Content source

https://www.koi.ai/blog/agreetosteal-the-first-malicious-outlook-add-in-leads-to-4-000-stolen-credentials

AgreeToSteal: The First Malicious Outlook Add-In Leads to 4,000 Stolen Credentials

A legitimate Outlook add-in was abandoned by its developer and silently taken over by a phishing operation. Over 4,000 credentials were stolen through Microsoft's own add-in store.

www.koi.ai

This is the first known malicious Microsoft Outlook add-in detected in the wild. But the developer who built it isn't the attacker.

In 2022, a developer built a meeting scheduling tool called AgreeTo and published it to the Microsoft Office Add-in Store. It worked. People liked it. Then the developer moved on, and the project died.

The add-in stayed listed in Microsoft's store. The URL it pointed to - hosted on Vercel - became claimable. An attacker claimed it, deployed a phishing kit, and Microsoft's own infrastructure started serving it inside Outlook's sidebar. By gaining access to the attacker's exfiltration channel, we were able to recover the full scope of the operation: over 4,000 stolen Microsoft account credentials, credit card numbers, and banking security answers. The attacker was actively testing stolen credentials yesterday. The infrastructure is live as you read this.

This is the story of how a dead side project became a phishing weapon. It starts with how Office add-ins work.

 

[Bot]

This KOI Research write-up (published February 11, 2026) is a good example of a “store-listed but remotely hosted” add-in turning into a supply-chain style phishing channel, without the original developer being the attacker. ([koi.ai](https://www.koi.ai/blog/agreetosteal-the-first-malicious-outlook-add-in-leads-to-4-000-stolen-credentials))

What actually made this possible

• Outlook web add-ins are essentially a signed manifest that tells Outlook which URL to load (typically in an iframe/task pane). The interactive content is fetched live from that URL each time. ([koi.ai](https://www.koi.ai/blog/agreetosteal-the-first-malicious-outlook-add-in-leads-to-4-000-stolen-credentials))
• In this case, the add-in’s URL was on Vercel and became claimable after the legitimate project was abandoned. An attacker took over the URL and served a Microsoft sign-in phishing flow inside Outlook. ([koi.ai](https://www.koi.ai/blog/agreetosteal-the-first-malicious-outlook-add-in-leads-to-4-000-stolen-credentials))
• KOI notes the manifest requested ReadWriteItem (mailbox read/modify) permissions, which is appropriate for some productivity add-ins, but becomes dangerous if the hosted content is later controlled by someone else. ([koi.ai](https://www.koi.ai/blog/agreetosteal-the-first-malicious-outlook-add-in-leads-to-4-000-stolen-credentials))

Why this matters (practically)

• It bypasses many “email gateway” expectations because the phishing UI isn’t delivered by an email; it’s delivered via the add-in surface inside Outlook. ([koi.ai](https://www.koi.ai/blog/agreetosteal-the-first-malicious-outlook-add-in-leads-to-4-000-stolen-credentials))
• Traditional endpoint detection may also have less to grab onto because it’s web content running inside a trusted Microsoft app context, not a newly dropped EXE. ([koi.ai](https://www.koi.ai/blog/agreetosteal-the-first-malicious-outlook-add-in-leads-to-4-000-stolen-credentials))
• The key risk pattern is not unique to Outlook: any “trusted listing + remotely hosted content” can become a problem if the hosting endpoint is later hijacked (expired domain, orphaned subdomain, deleted cloud project, etc.). ([koi.ai](https://www.koi.ai/blog/agreetosteal-the-first-malicious-outlook-add-in-leads-to-4-000-stolen-credentials))

What users should do (low-risk, actionable)

• Audit and remove unused Outlook add-ins, especially anything you don’t recognize. Microsoft’s end-user guidance for managing/removing Office add-ins is here. ([support.microsoft.com](https://support.microsoft.com/en-us/office/view-manage-and-install-add-ins-for-excel-powerpoint-and-word-16278816-1948-4028-91e5-76dca5380f8d?utm_source=openai))
• If you ever entered credentials into an in-Outlook “sign in” pane that didn’t look exactly right: change your Microsoft account password immediately and enable MFA (preferably phishing-resistant options where available).
• Review recent sign-in activity / security info for your Microsoft account (unfamiliar IPs, devices, OAuth consents).

What Microsoft 365 admins can do (defensive posture)

• Reduce add-in exposure: restrict user ability to acquire Office Store add-ins and move to an allow-list model where possible (only approved add-ins). (Many organizations do this as part of baseline hardening.) ([tenable.com](https://www.tenable.com/audits/items/CIS_Microsoft_365_v3.1.0_E3_Level_1.audit%3A15f4f0f406510ddfba35bef848f3780a?utm_source=openai))
• Monitor and respond: use Entra ID sign-in logs and Conditional Access to detect/limit suspicious access; require strong MFA for Outlook/Exchange access.
• Consider web/DNS filtering to block known IOCs when appropriate (KOI lists “outlook-one.vercel[.]app” and add-in ID “WA200004949”), but avoid broad-blocking entire shared hosting domains unless you’ve assessed business impact. ([koi.ai](https://www.koi.ai/blog/agreetosteal-the-first-malicious-outlook-add-in-leads-to-4-000-stolen-credentials))

Important note on “is it still live?”
KOI states the campaign infrastructure was live at the time of publishing (February 11, 2026), and that the attacker was actively testing stolen credentials “yesterday” (i.e., February 10, 2026, relative to their post). I can’t safely confirm from here whether Microsoft/Vercel/Telegram have fully taken it down since then, so treat it as potentially active unless you see authoritative takedown confirmation. ([koi.ai](https://www.koi.ai/blog/agreetosteal-the-first-malicious-outlook-add-in-leads-to-4-000-stolen-credentials))

Sources

• AgreeToSteal: The First Malicious Outlook Add-In Leads to 4,000 Stolen Credentials
• Microsoft Store Outlook add-in hijacked to steal 4,000 Microsoft accounts
• First Malicious Outlook Add-In Found Stealing 4,000+ Microsoft Credentials
• View, manage, and install add-ins for Excel, PowerPoint, and Word - Microsoft Support

 

[Wrecker4923]

In 2022, a developer built a meeting scheduling tool called AgreeTo and published it to the Microsoft Office Add-in Store. It worked. People liked it. Then the developer moved on, and the project died.

The add-in stayed listed in Microsoft's store. The URL it pointed to - hosted on Vercel - became claimable. An attacker claimed it, deployed a phishing kit, and Microsoft's own infrastructure started serving it inside Outlook's sidebar.

OOPS. I hope all the browser extension packages are hosted in the browser stores and not like what's described here...

 

[Halp2001]

An abandoned add-in is like an old bridge in the middle of the forest: nobody repairs it, the planks creak… and one day a bandit shows up, painting it in bright colors to lure unsuspecting walkers. Whoever crosses with confidence ends up in the river, with their credentials floating away like paper boats.

 

[ForgottenSeer 123960]

This exploit is conditional. It only affects users who previously installed the "AgreeTo" add-in or downloaded it from the store while the hijack was active. It does not auto-propagate to all Outlook users.