Outlook add-in hijack illustrates third-party identity risk

Original reporting date: 2026-02-11 · Source: BleepingComputer

What happened

An abandoned Outlook add-in became a phishing vector after attackers gained control over its external web endpoint.

Why it matters to businesses

Marketplace availability is not a substitute for supplier, permissions and lifecycle reviews.

Practical IT checklist

• Review active Office add-ins and OAuth grants.
• Disable unused or abandoned integrations.
• Adopt application approval and conditional-access policies.

Source and full reporting: BleepingComputer ↗

Original VALUE360 editorial summary and practical commentary; not a reproduction of the source article.