Microsoft fixed an exploited Outlook vulnerability that can expose a user’s Windows authentication information. An attacker must persuade a recipient to open a specially crafted message file; Outlook then connects to an attacker-controlled network location without its usual warning.
This attack targeted an exploited Outlook spoofing vulnerability, tracked as CVE-2026-124194. The method relied on simple social engineering rather than complex technical exploitation. An attacker sent a specially crafted message file and convinced the recipient to open it in an affected version of Microsoft Outlook. The victim had to be tricked into opening the malicious file for the attack to succeed, meaning no automatic exploitation occurred without user interaction.
Once opened, the file could cause Outlook to connect to an attacker-controlled network location. Normally, Outlook displays a warning before connecting to external content, but this crafted file bypassed that warning entirely. That silent connection could disclose the victim's NTLMv2 authentication hash, information an attacker could then use to authenticate as that user.
The attack succeeded because it exploited a basic human assumption: that opening a file attachment is routine and safe, especially when the usual external-content warning does not appear. Without that visual cue, recipients had no obvious signal that anything unusual was happening. Microsoft noted that the Outlook Preview Pane could not trigger the vulnerability, so the victim had to actively open the file, a step attackers achieved through a believable pretext.
This reflects a broader pattern in phishing and credential theft: attackers rely on a target performing one small, seemingly ordinary action, like opening an attachment, to unlock a much larger compromise.
Organizations and individuals using Microsoft Outlook, including enterprise and education environments on Windows 11, should treat unexpected attachments with caution regardless of how legitimate the sender appears. Verifying unusual requests through a separate, known contact method before opening any file reduces the chance of falling for this type of lure.
Applying Microsoft's security updates promptly to affected Outlook and Office products, including Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024, closes the underlying flaw. IT administrators and security awareness teams should reinforce that the absence of a warning dialog is not a reliable indicator of safety, since a crafted file can bypass it. Combining prompt patching with user awareness training around attachment handling addresses both the technical and human elements of this threat.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
An attacker sends a specially crafted message file and convinces the recipient to open it in Outlook, which can then connect to an attacker-controlled network location without showing the normal external-content warning.
Opening the malicious file can disclose the victim's NTLMv2 authentication hash, which an attacker could use to authenticate as that user.
No, Microsoft stated that the Outlook Preview Pane cannot trigger the vulnerability; the victim must actively open the malicious file.
Avoid opening unexpected message files or unfamiliar attachments, verify requests through a known contact method, and apply Microsoft's security updates promptly.
“Please open the attached message file.” That’s the trap. Open that crafted file in Outlook, and CVE-2026-124194 can make Outlook contact an outside network location, without its usual external-content warning. That silent connection can expose your Windows NTLMv2 login hash. The aha: Preview Pane won’t trigger this. Opening the file can. Unexpected Outlook message file? Don’t open it. Confirm the request using a contact method you already know.
Researchers observed a real phishing campaign that abused Microsoft 365’s Direct Send feature to make emails look like they came from the victim organization’s own domain, without compromising an employee account. The campaign was timed to mimic human sending patterns during U.S. Eastern business…
This weekly threat bulletin describes real incidents where attackers used human manipulation to break in, including social engineering at Levi Strauss and a Microsoft 365 credential-theft phish at defense supplier IEH. It also highlights a Lazarus-linked campaign using fake job offers and…
Attackers exploited an Outlook flaw by sending specially crafted message files and persuading recipients to open them. Opening the file makes Outlook connect to an attacker-controlled network location without its normal warning, potentially exposing the recipient’s password hash for attackers to…
Attackers reportedly spent months targeting Binance engineers, using a tampered software installer and fake job interviews with a malicious technical assignment. After gaining access through employee devices and credentials, they abused internal systems to authorize transfers from Binance hot…
Iran-aligned DarkBlinders used convincing recruitment offers while posing as Dubai Airports recruiters to target a high-value job seeker in Iraq. The victim was asked to complete what appeared to be a coding assessment, but the assessment package installed malware. The group also used lookalike…
Microsoft reports that North Korean threat actors are using AI to make job scams, fake recruiter outreach, fraudulent worker identities, and targeted phishing campaigns faster and more convincing. One group posed as recruiters for a spoofed AI blockchain company and scheduled software-engineer…
