At first, AgreeTo was nothing more than a small, convenient meeting‑scheduling tool, published on the Microsoft Add‑in Store and maintained as an open-source project. After a final update in late 2022, the project was abandoned in 2023; yet the add‑in remained listed and functional within the Microsoft 365 ecosystem, because its mechanism relies on an XML manifest that loads an external web page each time it runs, with no continuous validation of the content served after initial approval.
The tipping point: outlook‑one.vercel.app
The entire attack hinges on a domain dynamically loaded by Outlook: outlook‑one.vercel.app. When the developer deleted their Vercel deployment, this subdomain became orphaned and available for re‑registration. Meanwhile, the add‑in continued to reference it, meaning an attacker only had to reclaim the same subdomain, host their own content, and see it served by Outlook as if it were the original interface. This scenario is known as a dangling domain: the reference remains valid, but ownership changes silently, and the attacker inherits the trust chain without altering the signed manifest.
The central element of this compromise is a single domain name: outlook‑one.vercel.app. This subdomain was the exact location where Microsoft loaded the add‑in’s interface. Once it became available, it should have been treated as a sensitive asset — a critical entry point in the add‑in’s trust chain. Allowing a domain or subdomain to fall back into the pool of available names is one of the most dangerous scenarios in cybersecurity.
Abusing a legitimate hosting provider to bypass defenses
Instead of registering a suspicious domain, the attacker leveraged vercel.app, a widely used and highly reputable hosting provider, making it unlikely to be blocked by security filters. Inside Outlook’s sidebar, the add‑in displayed an almost perfect imitation of Microsoft’s login page; the victim entered their credentials, which were exfiltrated via a Telegram bot before being cleanly redirected to login.microsoftonline.com, making the operation undetectable. The use of a vercel.app subdomain capitalized on the provider’s global reputation and the widespread use of its shared infrastructure by legitimate services.
This was not a sophisticated attack: no advanced technical exploitation, no complex compromise. The entire operation depended on a forgotten subdomain, implicit trust, and an architecture that never revalidates the content loaded after publication. It was a low‑tech, high‑impact attack made possible by the lack of lifecycle monitoring of domain names tied to active services.
What makes this attack particularly alarming is that it does not rely on a software vulnerability: it exploits a web dependency and one‑time static validation. Office add‑ins are simply manifests instructing Outlook to embed a URL inside an iframe; Microsoft reviews the manifest once, signs it, and lists the add‑in in the store, but never re‑audits the content served by the URL months or even years later. This approve once, load forever model expands the attack surface to hosting providers and associated DNS records.
In this case, the domain name is not a detail; it is the execution mechanism itself. The add‑in’s manifest references a URL; as long as that URL responds, Outlook loads whatever the server provides. When outlook‑one.vercel.app transitions from being deployed by the legitimate developer to being reallocated to a third party, the entire logic of the add‑in shifts to the attacker without changing a single byte in the store. Defenders must treat a technical subdomain in production as a critical asset — on par with certificates, secrets, or source repositories.
What the approval chain doesn’t see… and should
The current validation process for add‑ins focuses on the manifest, not on maintaining trust over time. The content of the URL is never re‑audited, even though its ownership, hosting infrastructure or purpose may change entirely. The result here was the delivery of a phishing login page from a URL that was still “compliant” with the manifest but no longer controlled by the original publisher. More broadly, the modern supply chain has shifted risk toward the resolution of dynamic web dependencies.
How this attack could have been stopped at the domain level
A properly configured domain‑monitoring process reveals the fatal sequence: deletion of the Vercel deployment, subdomain becoming available, re‑registration by a new account, then the appearance of entirely new content with different characteristics. By correlating these signals with the fact that the URL is referenced by a production application or add‑in, you get a high‑priority risk indicator that must be acted upon before the attacker deploys their kit.
The role of the .vercel.app certificate: an almost perfect disguise
The use of the wildcard certificate *.vercel.app made this attack significantly harder to detect. Wildcard certificates cover all subdomains under a single domain, allowing outlook‑one.vercel.app to appear completely legitimate. No TLS anomaly was visible: valid certificate, correct chain of trust, reputable provider. This complete absence of SSL warnings allowed the reclaimed subdomain to continue to appear trustworthy — both to Outlook and to security systems.
Vigidomaine: restoring visibility over critical DNS assets
Vigidomaine provides reliable monitoring of domain names and their DNS configurations. The platform detects publicly visible variations, technical changes, DNS evolutions, and risks linked to domain expiration that could lead to reappropriation by a third party. By keeping track of these weak but meaningful signals, Vigidomaine helps anticipate at‑risk situations and prevents a simple oversight or poor domain management from escalating into a large‑scale compromise. You can try it for free today to strengthen your security and anticipate threats before they turn into real incidents : Vigidomaine
source :
https://www.it-connect.fr/comment-une-extension-outlook-officielle-a-ete-piegee-pour-derober-4-000-comptes-microsoft/
https://www.numerama.com/cyberguerre/2178393-oubliee-puis-piratee-cet-extension-outlook-sest-transformee-en-outil-de-vol-de-mots-de-passe.html