Microsoft 365 Outlook Add-ins Weaponized to Exfiltrate Sensitive Email Data Without Leaving Traces
An architectural vulnerability within the Microsoft 365 ecosystem has been identified, allowing unauthorized access to email data without forensic detection. This method, termed "Exfil Out&Look," exploits the Outlook add-in framework to intercept…
An architectural vulnerability within the Microsoft 365 ecosystem has been identified, allowing unauthorized access to email data without forensic detection. This method, termed "Exfil Out&Look," exploits the Outlook add-in framework to intercept outgoing emails covertly.
The attack does not depend on software vulnerabilities but rather on exploiting legitimate features in Outlook Web Access (OWA) to bypass Unified Audit Logs, making the data exfiltration undetectable by standard security monitoring tools .
The attack utilizes Outlook add-ins, which are applications developed using HTML, CSS, and JavaScript. The add-ins are managed through a manifest file (XML) that specifies permissions and integration points within Office products.
Research indicates that a malicious add-in can be engineered using the OnMessageSend event, originally intended to enable applications to process emails before sending. By configuring the manifest file with minimal permissions, specifically the ReadWriteItem capability, the add-in can access the subject line, body content, and recipient information of an email.
The execution of this malicious JavaScript payload occurs asynchronously, using a simple fetch() call to transmit the captured data to an attacker-controlled server. This process does not disrupt user experience nor require elevated privileges like Mailbox.Read , which would raise alerts.
This method, termed "Exfil Out&Look," exploits the Outlook add-in framework to intercept outgoing emails covertly.
Logging Discrepancies and Security Implications
Discrepancies in logging behavior have been noted between Outlook Desktop and Outlook Web Access . Installing an add-in via Outlook Desktop generates an Event ID 45 in the Windows Event Viewer, creating a local artifact for forensic investigation. In contrast, installations through OWA do not generate corresponding entries in Microsoft 365 Unified Audit Log.
This gap allows an attacker, whether an external threat actor or a malicious insider, to install a persistent data-harvesting add-in without detection. Even with Microsoft 365 E5 licenses and full auditing enabled, the add-in installation and execution remain unrecorded.
The research underscores the absence of evidence within the Microsoft 365 tenant to correlate outbound network traffic with email content access or exfiltration.
These findings were disclosed to the Microsoft Security Response Center (MSRC) on September 30, 2025. Microsoft classified the issue as a "low-severity product bug or suggestion," with no immediate fix or patch planned. Consequently, the "Exfil Out&Look" technique remains a potential risk for data theft.
To mitigate this risk, security teams are advised to shift from reliance on default logs to proactive governance. Administrators should enforce strict policies on add-in installations by blocking user-initiated installations and managing allow-lists exclusively through the Microsoft 365 admin center.
Organizations should also monitor for unusual service principal creations or application registrations in Azure Active Directory , as these may indicate the deployment of a malicious add-in across the organization.
Based on reporting by Cyber Security News.