“Microsoft just said they couldn’t reproduce it without providing any details.”
Vsevolod Kokorin sent Microsoft a full proof of concept and a video of the exploit, and Microsoft said it couldn’t reproduce it. The bug lets anyone send Outlook users email that looks like it came from Microsoft’s account security team, and Outlook has at least 400 million users. Microsoft reopened one of his old reports only after he went public. Its president testified to Congress about security failures the same week.