CVE-2023-23397: How a Single Outlook Email Could Lead to Silent Email Theft

Email remains one of the most critical communication tools for businesses, nonprofits, and government organizations. Unfortunately, it is also one of the most heavily targeted attack surfaces. In 2023, Microsoft disclosed one of the most dangerous Outlook vulnerabilities seen in years: CVE-2023-23397.

What made this vulnerability particularly concerning was not just its severity, but the fact that it could be exploited with little to no user interaction. A victim did not need to click a link, open an attachment, or even read the message. Simply receiving a specially crafted email could be enough to expose credentials that attackers could then use to compromise accounts, steal information, and establish long-term persistence.

Understanding how CVE-2023-23397 worked and how organizations can protect themselves remains important today because many of the techniques used by attackers continue to be effective against poorly secured environments.

---

What Is CVE-2023-23397?

CVE-2023-23397 is a privilege escalation and credential theft vulnerability affecting Microsoft Outlook for Windows.

The flaw abused Outlook’s handling of reminders and notification sounds. An attacker could create a specially crafted email, calendar invitation, or task request that referenced a file located on a malicious SMB (Server Message Block) share controlled by the attacker.

When Outlook attempted to access that remote resource, Windows would automatically attempt to authenticate to the attacker’s system using the victim’s Net-NTLM credentials.

Because this process occurred automatically, the victim often never realized anything had happened.

The attacker could then capture the authentication hash and use it in:

• Pass-the-Hash attacks
• Credential relay attacks
• Lateral movement within a network
• Exchange or Microsoft 365 account compromise
• Additional privilege escalation activities

This made CVE-2023-23397 particularly dangerous because it effectively transformed Outlook into a credential harvesting mechanism.

---

Why Was It So Serious?

Most phishing attacks rely on convincing users to take an action:

• Click a link
• Open an attachment
• Enter credentials
• Approve MFA requests

CVE-2023-23397 removed much of that requirement.

A malicious email could trigger the authentication attempt automatically, allowing attackers to collect credentials without relying on user awareness or training.

For organizations that lacked modern authentication controls, the consequences could be severe.

Once attackers obtained valid credentials, they could:

• Access mailboxes
• Search sensitive communications
• Download attachments
• Impersonate users
• Establish persistence
• Conduct business email compromise (BEC) attacks

In many documented incidents, attackers leveraged stolen credentials to maintain access long after the original email had been delivered.

---

The Connection to Malicious Inbox Rules

One of the most common post-compromise activities associated with Outlook and Exchange attacks is the creation of hidden inbox rules.

After gaining access to an email account, attackers often create rules that:

• Forward copies of all incoming mail to external accounts
• Redirect messages from specific individuals
• Delete security notifications
• Move invoices and payment requests to hidden folders
• Hide evidence of compromise from the victim

These rules can remain active for weeks or months before discovery.

In a Business Email Compromise (BEC) scenario, attackers frequently monitor conversations between vendors, customers, executives, and accounting staff. They wait for a payment opportunity and then inject fraudulent banking information into an otherwise legitimate email thread.

The result can be significant financial losses despite no malware ever being installed on a workstation.

---

Who Was at Risk?

The vulnerability primarily affected:

• Microsoft Outlook for Windows
• Organizations using Exchange Server
• Microsoft 365 users with Outlook desktop clients
• Hybrid Exchange environments

While Outlook Web Access (OWA) itself was not directly vulnerable to CVE-2023-23397, compromised credentials obtained through the attack could subsequently be used to access OWA, Exchange Online, and other Microsoft 365 services.

Organizations that relied heavily on legacy authentication protocols faced particularly high risk because stolen Net-NTLM credentials could be leveraged more easily.

---

How Microsoft Addressed the Vulnerability

Microsoft released security updates that corrected the vulnerable behavior within Outlook.

Organizations should ensure that:

• Outlook clients are fully patched
• Windows systems receive regular security updates
• Exchange environments are maintained and monitored
• Legacy authentication methods are disabled where possible

Microsoft also provided detection scripts and guidance to help administrators identify potentially malicious messages that exploited the vulnerability.

However, patching alone is not enough.

---

Prevention and Deterrence Strategies

1. Keep Outlook and Windows Updated

The most important defense is ensuring all systems receive security updates promptly.

Organizations should maintain:

• Automated patch management
• Vulnerability scanning
• Asset inventories
• Update verification procedures

Unpatched systems remain attractive targets long after vulnerabilities become public.

---

2. Enforce Multi-Factor Authentication (MFA)

MFA significantly reduces the value of stolen credentials.

Even if attackers obtain passwords or authentication hashes, MFA can prevent successful account access.

Whenever possible:

• Require MFA for all users
• Require MFA for administrators
• Eliminate MFA exceptions
• Use phishing-resistant MFA methods where practical

---

3. Disable Legacy Authentication

Legacy authentication protocols are frequently abused after credential theft.

Organizations should disable:

• Basic Authentication
• POP3 (unless required)
• IMAP (unless required)
• SMTP AUTH where unnecessary

Modern authentication methods provide stronger protections and better logging.

---

4. Monitor Mailbox Rules

Administrators should routinely review mailbox rules for suspicious behavior.

Look for:

• External forwarding addresses
• Hidden rules
• Automatic deletions
• Unusual redirects
• Recently created rules

Many compromises are discovered only after investigators review mailbox configuration changes.

---

5. Restrict External Auto-Forwarding

A simple but highly effective control is disabling automatic forwarding to external email addresses.

Many organizations have no legitimate business need for unrestricted forwarding.

Blocking external forwarding can prevent attackers from silently siphoning email even if an account becomes compromised.

---

6. Deploy Advanced Email Security

Solutions such as:

• Microsoft Defender for Office 365
• Advanced threat protection platforms
• Security information and event management (SIEM) tools
• Managed detection and response (MDR) services

can help identify suspicious behavior before significant damage occurs.

---

7. Review Sign-In Logs Regularly

Microsoft 365 administrators should routinely monitor:

• Unusual login locations
• Impossible travel events
• Failed login attempts
• New devices
• Suspicious OAuth application activity

Early detection often makes the difference between a minor incident and a major breach.

---

Final Thoughts

I originally saw this kind of exploitation long before Office was a cloud service offering. PDF dropping executables were usually the delivery mechanism, but lately everyone seems to refer back to this CVE, and thus my focus on it.

CVE-2023-23397 serves as a reminder that modern cyberattacks do not always require users to make mistakes. In this case, a specially crafted Outlook message could trigger credential theft automatically, potentially leading to mailbox compromise, malicious forwarding rules, financial fraud, and long-term persistence.

Organizations should view this vulnerability as more than a historical event. It highlights the importance of layered security controls, including timely patching, multi-factor authentication, disabling legacy authentication, monitoring mailbox rules, and maintaining strong Microsoft 365 security practices.

The lesson from CVE-2023-23397 is clear: protecting email is no longer just about stopping phishing clicks. It is about securing the entire identity and messaging ecosystem before attackers can turn a single email into a full-scale compromise.

References

• Microsoft Security Response Center – CVE-2023-23397
• Microsoft Security Blog – Guidance for Investigating Attacks Using CVE-2023-23397
• Microsoft Security Response Center – Microsoft Mitigates Outlook Elevation of Privilege Vulnerability
• National Vulnerability Database (NVD) – CVE-2023-23397
• Canadian Centre for Cyber Security Advisory on CVE-2023-23397
• Palo Alto Networks Unit 42 Threat Brief – CVE-2023-23397

Securing Your Microsoft 365 Tenant: Why Native Security Isn’t Always Enough

Microsoft 365 has become the productivity platform of choice for organizations of all sizes. It provides powerful tools for email, collaboration, file sharing, communication, and business operations. However, as Microsoft 365 adoption has increased, so has the number of cybercriminals targeting organizations through compromised email accounts, business email compromise (BEC), phishing attacks, malicious file sharing, and unauthorized access attempts.

Many organizations mistakenly assume that because they are using Microsoft 365, they are automatically protected against modern cyber threats. While Microsoft provides a solid foundation of security capabilities, protecting a Microsoft 365 environment requires ongoing monitoring, threat detection, incident response, user awareness, and security expertise that many organizations simply do not have available internally.

This is where solutions such as Sherweb’s Office Protect can significantly strengthen an organization’s security posture.

The Growing Threat to Microsoft 365 Environments

Cybercriminals increasingly target Microsoft 365 accounts because they often serve as the gateway to an organization’s most valuable assets:

• Email communications
• Financial records
• Customer information
• Employee data
• SharePoint files
• OneDrive content
• Teams conversations
• Business applications integrated through Microsoft Entra ID

A single compromised account can provide attackers with access to sensitive information, allowing them to:

• Send fraudulent invoices
• Redirect payments
• Steal confidential data
• Deploy ransomware
• Create hidden mailbox rules
• Conduct internal phishing campaigns
• Impersonate executives or vendors

Many attacks are designed to remain undetected for weeks or months, allowing criminals to gather information before executing financial fraud schemes.

Common Risks Without Advanced Monitoring

Organizations that rely solely on default configurations or limited administrative oversight often face several significant risks.

Business Email Compromise (BEC)

BEC attacks remain one of the most financially damaging cybercrime categories worldwide. Attackers gain access to a mailbox and monitor communications until an opportunity arises to manipulate payments, banking information, or vendor relationships.

Because these emails originate from legitimate accounts, they can be extremely difficult for employees to identify.

Suspicious Login Activity

Cybercriminals frequently attempt to access Microsoft 365 accounts using:

• Stolen passwords
• Credential stuffing attacks
• Password spray attacks
• Leaked credentials from third-party breaches

Without active monitoring, suspicious sign-ins from foreign countries, anonymous proxies, VPN services, or unusual devices may go unnoticed until damage has already occurred.

Unauthorized Mailbox Rules

One of the first actions attackers often take after compromising an account is creating hidden mailbox rules.

These rules can:

• Forward email externally
• Delete security notifications
• Move messages into hidden folders
• Conceal communications from users

The victim may continue using their account without realizing critical messages are being intercepted.

Malicious OAuth Applications

Modern attackers increasingly exploit OAuth permissions rather than stealing passwords. Users may unknowingly grant a malicious application access to:

• Email
• Contacts
• Calendars
• Files
• Teams data

Even after a password reset, the malicious application may retain access if not properly identified and removed.

Internal Account Compromise

Once an attacker gains access to one account, they often use that trust relationship to target coworkers.

Employees are far more likely to trust:

• Internal email messages
• Teams chats
• Shared documents
• File requests

This allows attackers to expand their access rapidly throughout an organization.

Why Security Alerts Alone Are Not Enough

Many Microsoft 365 tenants generate security alerts, but alerts only provide value when someone is actively reviewing and responding to them.

A common misconception is that security notifications automatically stop attacks. In reality:

• Alerts may go unread.
• Administrators may not understand their severity.
• Small organizations may not have dedicated security personnel.
• Threats occurring after business hours may remain unchecked.

Cyber incidents rarely occur at convenient times.

Organizations often discover compromises only after:

• Customers report suspicious emails.
• Vendors question payment requests.
• Financial losses occur.
• Regulatory reporting obligations arise.

The Value of Sherweb Office Protect

Sherweb Office Protect helps bridge the gap between basic Microsoft 365 security and a more proactive security strategy.

Office Protect provides centralized security management designed specifically for Microsoft 365 environments and offers enhanced visibility into security risks that many organizations would otherwise miss.

Key benefits include:

Enhanced Security Monitoring

Office Protect continuously monitors tenant activity and identifies potentially suspicious events, helping administrators detect issues before they escalate into major incidents.

Security Posture Management

The platform evaluates Microsoft 365 security settings and identifies areas where security controls can be strengthened.

This helps organizations implement best practices and reduce unnecessary exposure.

User Risk Visibility

Administrators gain visibility into risky behaviors and potentially compromised accounts, allowing them to prioritize remediation efforts and focus resources where they are most needed.

Simplified Security Administration

Many organizations struggle to navigate Microsoft’s extensive security ecosystem.

Office Protect provides a more streamlined interface and consolidated security insights, making it easier to manage Microsoft 365 security without requiring specialized expertise.

Faster Incident Detection

The sooner suspicious activity is identified, the less damage an attacker can cause.

Early detection can mean the difference between:

• A password reset and minor cleanup
• A major breach requiring legal, regulatory, and financial remediation

Security Is a Process, Not a Product

No security solution can eliminate all risk. Effective cybersecurity requires multiple layers working together, including:

• Multi-factor authentication (MFA)
• Strong password policies
• Security awareness training
• Email protection
• Endpoint protection
• Backup and recovery
• Continuous monitoring
• Incident response planning

However, organizations that lack visibility into their Microsoft 365 environment are often operating with significant blind spots.

Office Protect helps reduce those blind spots by providing additional monitoring, security insights, and administrative controls that improve an organization’s ability to detect and respond to threats targeting Microsoft 365.

Final Thoughts

Microsoft 365 is one of the most targeted business platforms in the world. As cybercriminals continue to refine their tactics, organizations must move beyond the assumption that default settings alone provide adequate protection.

The financial and operational impact of a compromised Microsoft 365 account can be severe, including fraud, business disruption, reputational damage, regulatory consequences, and loss of customer trust.

By implementing additional security controls and leveraging solutions such as Sherweb Office Protect, organizations can improve visibility, strengthen defenses, and reduce the likelihood that a single compromised account becomes a major business incident.

Cybersecurity is no longer just an IT concern—it is a business risk management requirement. Investing in stronger Microsoft 365 security today can help prevent costly incidents tomorrow.

A small company hired a new cybersecurity consultant after a phishing incident.

Day one, he walked into the office and asked, “How many people clicked the phishing email?”

The IT manager sighed. “About 40%.”

“That’s bad,” said the consultant.

“Actually,” replied the manager, “that’s an improvement. Last year it was 90%.”

Determined to fix things, the consultant launched mandatory security awareness training.

A month later, he sent a fake phishing test:

Subject: FREE PIZZA IN THE BREAK ROOM

Within two minutes, 73 employees clicked.

Within five minutes, someone replied-all:

“There is no pizza. This is another one of Kevin’s stupid tests.”

The consultant was disappointed.

Then he noticed the CEO had clicked too.

He walked into the CEO’s office and asked, “Why did you click it?”

The CEO shrugged.

“Because if there was free pizza and I didn’t click, I’d look stupid.”

The consultant updated the training.

Next month he sent another test:

Subject: IMPORTANT PAYROLL CORRECTION — ACTION REQUIRED

Only three people clicked.

Huge improvement.

Then payroll called.

Every employee had received the email, panicked, and immediately called payroll to ask if their paycheck was safe.

The payroll department suffered a complete operational collapse for six hours.

The consultant proudly reported a phishing click rate of only 1.5%.

The CFO stared at him.

“You shut down payroll for an entire day.”

“Correct.”

“And you consider that a success?”

“Absolutely.”

“How?”

The consultant pointed at his report.

“Nobody entered their password.”

The CFO rubbed his temples.

“Kevin…”

“Yes?”

“Next month, send the pizza email.”

The consultant smiled.

“Already scheduled.”