Outlook Add‑in Compromise: Agree To and the Hidden Supply Chain Risk

Security researchers have uncovered the first documented case of a malicious Microsoft Outlook add‑in being used in real‑world attacks. The compromised meeting scheduler AgreeTo was hijacked to steal over 4,000 Microsoft account credentials, credit card numbers, and banking security answers.

How the Attack Happened

• Legitimate origins: AgreeTo launched in December 2022 as an open‑source meeting scheduler, gaining positive reviews.
• Abandonment: The developer later deleted its hosting infrastructure, leaving the add‑in’s URL orphaned.
• Hijack: An attacker claimed the abandoned URL and deployed a phishing kit.
• Trusted delivery: Because the add‑in remained in Microsoft’s store, Outlook users saw the attacker’s fake login page directly in the sidebar.

Technical Flaw: Remote Dynamic Dependencies

Office add‑ins aren’t traditional software—they’re XML manifests that load remote URLs in iframes.

• Microsoft reviews the manifest only at submission.
• No continuous verification of live hosted content occurs.
• Result: attackers swapped the legitimate tool for a phishing page without triggering a new review.

Impact

• 4,000 victims → Microsoft credentials, credit card data, banking security answers.
• Permissions → The add‑in had “ReadWriteItem” rights, technically allowing email access, though the campaign focused on credential theft.
• Targeting → Banking details linked to Canadian institutions.

Defensive Lessons

• Supply chain vigilance: Even trusted add‑ins can silently become malicious years later.
• Continuous monitoring: Vendors must verify hosted content beyond initial approval.
• User awareness: Train employees to treat unexpected login prompts—even inside trusted apps—with caution.
• Permissions review: Limit add‑in privileges to reduce potential abuse.

Final Thought

The AgreeTo incident highlights a critical blind spot in SaaS ecosystems: abandoned projects can be hijacked and weaponized long after initial approval. For defenders, the lesson is clear—trust must be continuously validated, not assumed.