CVE-2023-23397: Outlook NTLM Credential Theft
Can Outlook leak credentials without opening email?
A critical zero-click vulnerability where a specially crafted email triggers an NTLM authentication request to an attacker-controlled SMB server. The victim does not need to open or preview the email — receiving it is sufficient for exploitation.
Impact & Exploitation
Exploited by Russian military intelligence (GRU). No user interaction required. Email receipt alone triggers credential theft, enabling lateral movement and domain compromise.
How Precogs AI Detects Outlook NTLM Credential Theft
Precogs AI identifies NTLM relay attack vectors in Windows application binaries and detects configurations susceptible to automatic outbound SMB authentication.
Precogs Research
This vulnerability intelligence report was analyzed and enriched by the Precogs AI Security Team. Our researchers continuously monitor emerging threats across AI code, LLM pipelines, and binary architectures to ensure accurate real-time remediation guidance.