Hackers Exploit Hidden Microsoft Outlook Flaw To Steal Login Data - Tampa Free Press
Federal cybersecurity officials confirmed Thursday that hackers are actively exploiting a newly discovered flaw in Microsoft Outlook to steal sensitive login credentials.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) verified that attackers are using the previously unknown vulnerability—tracked as CVE-2026-124194—in live attacks rather than just theoretical tests. Microsoft classified the issue as a network-spoofing vulnerability and gave it a severity rating of 6.5 out of 10 on the Common Vulnerability Scoring System.
Exploit Method
According to a Microsoft security advisory, the exploit relies on social engineering to succeed. An attacker sends a specially crafted message file to a target and convinces them to open it inside Outlook. Once the user opens the file, the email program silently connects to an external network location controlled by the hacker.
Normally, Outlook triggers a warning prompt before connecting to outside content, but this flaw lets attackers bypass that alert completely.
Response
Microsoft has now released security updates to close the loophole, and federal officials are urging both everyday users and corporate IT teams to install the patches immediately. Authorities also advise exercising caution before opening unexpected or suspicious message files.
Microsoft said on Thursday, "We're investigating reports of users experiencing issues accessing Exchange Online mailboxes through multiple connection methods in the Americas. More details can be found in the Microsoft 365 admin center under EX1550543." Neither Microsoft nor CISA has disclosed how many people or organizations have been compromised by the attacks so far.
Related
