Zerodium Offering $400,000 For Microsoft Outlook Zero-Day Exploits

The exploit acquisition firm Zerodium this week showed increased interest in buying zero-day exploits targeting the popular email clients Microsoft Outlook and Mozilla Thunderbird.

The company was already looking to acquire Microsoft Outlook zero-day exploits, but this week it announced higher maximum payouts for them, up from $250,000 to $400,000, yet only temporarily.

“We are looking for zero-click exploits leading to remote code execution when receiving/downloading emails in Outlook, without requiring any user interaction such as reading the malicious email message or opening an attachment,” the company says.

Zerodium is also willing to pay for exploits that require user interaction, such as opening and reading an email, but says it will pay less for those.

The company’s announcement comes the same day a Trustwave researcher disclosed details of a new method of bypassing an Outlook security feature to deliver malicious links to victims. Microsoft addressed the bypass in the summer of 2021.

This week, Zerodium also announced its interest in acquiring zero-day exploits targeting Thunderbird and leading to remote code execution.

For exploits that only require receiving/downloading emails, but no user interaction, the company is willing to pay up to $200,000. Zerodium says it may also acquire exploits that require opening/reading an email, but for a lower reward.

The company has yet to announce when these limited time offers will end.

Zerodium increases payouts for Outlook zero-day exploits