CVE-2023-23397: Outlook NTLM Credential Theft
Can Outlook leak credentials without opening email?
A critical zero-click vulnerability where a specially crafted email triggers an NTLM authentication request to an attacker-controlled SMB server. The victim does not need to open or preview the email — receiving it is sufficient for exploitation.
Impact & Exploitation
Exploited by Russian military intelligence (GRU). No user interaction required. Email receipt alone triggers credential theft, enabling lateral movement and domain compromise.
Precogs Research
This vulnerability intelligence report was analyzed and enriched by the Precogs AI Security Team. Our researchers continuously monitor emerging threats across AI code, LLM pipelines, and binary architectures to ensure accurate real-time remediation guidance.