New Security Warning For 400 Million Outlook Users As Email Bug Revealed

A security researcher has issued a warning to all 400 million users of Microsoft Outlook after discovering an email bug that could allow anyone to impersonate official Microsoft accounts.

Vsevolod Kokorin, a security researcher at SolidLab, posted a message on X, formerly known as Twitter, expressing frustration with Microsoft after he had uncovered and responsibly disclosed a serious vulnerability impacting Outlook email, only to be told it couldn’t be reproduced.

The bug, which Kokorin rightly refuses to provide the technical details needed to exploit it at this time, enables anyone sending an email to another Outlook user to impersonate official Microsoft corporate accounts. As shown in the example posted to X, this means an email can appear to come from Microsoft’s security team, with all the implications for phishing, malware distribution and cybercrime that brings with it.

ForbesGmail Access From Outlook.com To Stop In 13 DaysBy Davey Winder

How To Mitigate The Risk Of New Outlook Spoofing Bug

While the vulnerability only appears to be exploitable when sending email from one Outlook user to another, given that there are around 400 million users it creates a huge threat surface.

Kokorin reached out to TechCrunch which has confirmed it received a spoofed email that did, indeed, appear to genuinely be from the Microsoft security team.

I have contacted Microsoft for a statement and will update this article in due course. Meanwhile, however, if you are an Outlook email user then it’s highly recommended that you stay alert to any requests you might receive that appear to be from Microsoft.

In an update to his original posting, Kokorin said of Microsoft that “at this point, they have acknowledged the issue,” which could mean a patch will be forthcoming if the vulnerability is found to be fixable. I sincerely hope it is, as Kokorin also said that the emails being spoofed passed the DMARC authentication tests that are meant to prevent just such a security threat.

The Security Expert View

Max Gannon, the cyber intelligence team manager at Condense, warned that, if confirmed, “this bug could allow the targeting of even the most suspicious and well-trained individuals.”

Gannon said that the reported vulnerability shows how reliant we are on companies like Microsoft to prevent such bugs. “It also highlights how important it is for major companies to take security researchers seriously and apply more than a token effort to verify bugs that have the potential to cause significant harm,” Gannon concluded.