Attackers exploited an Outlook flaw by sending specially crafted message files and persuading recipients to open them. Opening the file makes Outlook connect to an attacker-controlled network location without its normal warning, potentially exposing the recipient’s password hash for attackers to reuse.
This attack centers on CVE-2026-124194, an Outlook spoofing vulnerability that Microsoft marked as actively exploited before a patch was available. The attack chain is simple on its face: an attacker sends a specially crafted message file and convinces a recipient to open it in Outlook. Once opened, Outlook connects to an attacker-controlled network location without showing the usual external-content warning. That silent connection discloses the user's NTLMv2 hash, which the attacker can then use to authenticate as that person.
The pretext used in this kind of scenario is deliberately mundane, a message file presented as something the recipient simply needs to review. There is no urgent language or impersonation required because the technical flaw does most of the work once the file is opened.
The attack succeeded because it exploited a gap in Outlook's normal safeguards rather than relying on an elaborate social engineering pretext. Users are conditioned to expect a warning before Outlook reaches out to external content, and the absence of that warning here meant there was no visible signal that anything unusual was happening. Because the required user action, opening an attached file, is such a routine part of email use, the request did not stand out as suspicious to most recipients.
Defenders and employees should treat the following as red flags:
Organizations using Microsoft Outlook or Exchange should prioritize this fix rather than assuming a lower severity score means it is safe to delay. Employees who handle email attachments, along with IT administrators and security operations teams, should be reminded to treat unexpected message-file attachments as suspicious and to report them instead of opening them. Since opening a malicious file can expose information attackers can use to log in as the victim, building a habit of pausing before opening unfamiliar attachments, and promptly applying security updates when active exploitation is reported, are the most direct ways to reduce exposure to this kind of attack.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It is an Outlook spoofing vulnerability that Microsoft marked as actively exploited before a patch was released. It involves a specially crafted message file that, when opened, can expose a user's password hash.
An attacker sends a specially crafted message file and convinces a recipient to open it. Opening the file causes Outlook to connect to an attacker-controlled network location without showing the usual external-content warning, which discloses the user's NTLMv2 hash.
The attacker can use that hash to authenticate as the user, potentially gaining unauthorized access to systems and accounts.
Yes, the vulnerability was marked as actively exploited before a patch existed, so it should be prioritized for patching and inboxes should be watched for suspicious files.
“Please review the attached message file.” In Outlook? Pause. With CVE-2026-124194, opening a specially crafted message file can make Outlook connect to an outside network location, without its usual warning. That silent connection can expose your NTLMv2 password hash, which could be used to log in as you. No warning doesn’t mean no risk. Unexpected message file from an unverified sender? Don’t open it, report the email.
Microsoft fixed an exploited Outlook vulnerability that can expose a user’s Windows authentication information. An attacker must persuade a recipient to open a specially crafted message file; Outlook then connects to an attacker-controlled network location without its usual warning.
Check Point and Microsoft report North Korea’s Lazarus Group used a long-running “Dream Job” social engineering campaign to target defense-sector job seekers with fake employer sites and trojanized documents/software. Victims were lured into opening malicious PDFs or installing a modified PDF…
Russia-aligned group Gorbag targeted Ukrainian public-sector and defense organizations with spearphishing emails disguised as administrative fines and tax matters. The messages delivered malicious files that stole browser passwords, VPN settings, documents, and electronic-signature keys,…
Russia-aligned Gorbag targeted Ukrainian government, law-enforcement, and defense organizations with spear-phishing emails disguised as official administrative fines or tax notices. The emails carried malicious attachments, including macro-enabled Excel files, that installed data-stealing malware…
Iran-aligned DarkBlinders used convincing recruitment offers while posing as Dubai Airports recruiters to target a high-value job seeker in Iraq. The victim was asked to complete what appeared to be a coding assessment, but the assessment package installed malware. The group also used lookalike…
A real phishing campaign is using convincing court notices to trick recipients into opening attachments or downloading files that deliver LodaRAT malware. The malware can steal browser session cookies and give attackers remote control of Windows systems. Employees should verify unexpected legal…
