An urgent warning has been issued to all 400 million Outlook users after a bug was uncovered that enables email spoofing. This vulnerability allows anyone to impersonate accounts, posing a significant risk of malicious emails being sent to other users.
A security researcher at SolidLab, Vsevolod Kokorin, shared his findings on X (formerly Twitter), demonstrating how the bug could be exploited to spoof Microsoft’s security email account. Kokorin’s demonstration revealed the potential for bad actors to deceive users by sending emails that appear to come from legitimate sources.
How to Protect Yourself:
- Be cautious when opening new emails.
- Avoid clicking on suspicious links.
- Verify the sender’s email address before taking any action.
Outlook is one of the most widely used email services worldwide, holding over 40 percent market share in the email managing market. It is particularly popular for business communications, making the discovery of this bug especially concerning.
Kokorin reported the flaw to Microsoft shortly after uncovering it months ago, but claims the company initially disregarded his findings. Microsoft allegedly informed him that they could not replicate the issue. In response, Kokorin sent a demonstration video to Microsoft and made his discovery public on X. He told TechCrunch, “Microsoft just said they couldn’t reproduce it without providing any details. Microsoft might have noticed my tweet because a few hours ago they reopened one of my reports that I had submitted several months ago.
TechCrunch confirmed the existence of the bug after receiving a spoof email from Kokorin. DailyMail.com has contacted Microsoft for comment.
Kokorin noted that he has previously reported other security issues to Microsoft, and the company was receptive. However, he has refused to reveal how the flaw can be exploited, stating that it only works when sending emails from one Outlook account to another.
The issue arose just two months after Microsoft CEO Satya Nadella announced a massive overhaul to ensure security is the company’s main focus. In an internal memo obtained by The Verge, Nadella emphasized that security was now Microsoft’s “top priority.” He wrote, “If you’re faced with the tradeoff between security and another priority, your answer is clear: Do security. In some cases, this will mean prioritizing security above other things we do, such as releasing new features or providing ongoing support for legacy systems.
Despite the urgency of the situation, Microsoft has yet to make a formal announcement regarding the bug discovered by Kokorin.
