Weekly Recap: Outlook Add-Ins Hijack, 0-Day Patches, Wormable Botnet & AI Malware
Summary: The legitimate AgreeTo add-in for Outlook was hijacked and turned into a phishing kit that stole more than 4,000 Microsoft account credentials, after attackers seized control of a domain tied to the abandoned project to serve a fake Microsoft login page. Microsoft has since removed the add-in from its store, and the recap also lists critical flaws including CVE-2026-2441 in Google Chrome, CVE-2026-20700 across Apple operating systems, and multiple Windows CVEs.
Bottom line: The add-in ran inside Outlook, could request permission to read and modify email, and was distributed through Microsoft's own store, which carries implicit trust - and it took an abandoned domain to turn it into a credential harvester that claimed more than 4,000 accounts.