Microsoft 365 Outlook Add-ins Weaponized – “Exfil Out&Look” Technique

Researchers have uncovered a serious blind spot in the Microsoft 365 ecosystem: attackers can weaponize Outlook add-ins to exfiltrate sensitive email data without leaving forensic traces. This technique, dubbed “Exfil Out&Look”, exploits legitimate Outlook features rather than traditional software vulnerabilities.

Attack Technique

• Framework abused: Outlook add-ins (built with HTML, CSS, JavaScript).
• Mechanism:
  • Add-ins use a manifest (XML) to define permissions and integration points.
  • Malicious add-in leverages the OnMessageSend event to intercept emails before they are sent.
  • With minimal permissions (ReadWriteItem), attackers can access subject, body, and recipient details.
  • Payload executes asynchronously, using fetch() to send stolen data to attacker-controlled servers.
• Stealth:
  • No elevated privileges (like Mailbox.Read) required.
  • No user/admin consent prompts triggered.
  • Runs invisibly in the background.

Logging Blind Spot

• Outlook Desktop: Installation generates Event ID 45 in Windows Event Viewer (forensic artifact).
• Outlook Web Access (OWA):
  • No entries in Microsoft 365 Unified Audit Logs.
  • Even with E5 licenses and full auditing enabled, add-in installation/execution remains unrecorded.
• Result: Malicious add-ins can persist indefinitely, undetected by standard monitoring.

Security Impact

• Attackers (external or insider) can:
  • Stealthily harvest sensitive email data.
  • Operate without triggering alerts or audit logs.
• Outbound traffic may be visible at the network boundary, but there’s no correlation inside Microsoft 365 to indicate exfiltration.
• Microsoft classified the issue as a “low-severity product bug/suggestion”, with no immediate fix planned.

Defensive Recommendations

• Governance over add-ins:
  • Block user-initiated add-in installations.
  • Enforce allow-lists via the Microsoft 365 admin center.
• Azure AD monitoring:
  • Watch for unusual service principal creations or application registrations (possible indicators of malicious add-ins).
• Network monitoring:
  • Inspect outbound traffic for suspicious fetch() calls or unrecognized destinations.
• Policy enforcement:
  • Treat add-in governance as part of data loss prevention (DLP) strategy.

Takeaway

The Exfil Out&Look technique highlights how attackers can exploit legitimate features rather than vulnerabilities, bypassing traditional detection. Organizations must pivot from reliance on default logs to proactive governance and monitoring to prevent stealthy email data theft.