
CVE-2024-21413 Outlook MonikerLink: NTLM Credential Theft via
CVE-2024-21413, dubbed 'MonikerLink' by Checkpoint Research, is a critical Microsoft Outlook vulnerability patched in February 2024. A crafted file:// hyperlink with an exclamation mark suffix bypasses Outlook's Protected View, causing Windows to silently authenticate to an attacker's server via NTLMv2, transmitting the victim's Net-NTLMv2 hash with no user interaction beyond opening or previewing the email. CISA added it to KEV after confirmed wild exploitation.
