The exploit acquisition firm Zerodium this week showed increased interest in buying zero-day exploits targeting the popular email clients Microsoft Outlook and Mozilla Thunderbird.
The company was already looking to acquire Microsoft Outlook zero-day exploits, but this week it announced higher maximum payouts for them, up from $250,000 to $400,000, yet only temporarily.
“We are looking for zero-click exploits leading to remote code execution when receiving/downloading emails in Outlook, without requiring any user interaction such as reading the malicious email message or opening an attachment,” the company says.
Zerodium is also willing to pay for exploits that require user interaction, such as opening and reading an email, but says it will pay less for those.
The company’s announcement comes the same day a Trustwave researcher disclosed details of a new method of bypassing an Outlook security feature to deliver malicious links to victims. Microsoft addressed the bypass in the summer of 2021.
This week, Zerodium also announced its interest in acquiring zero-day exploits targeting Thunderbird and leading to remote code execution.
For exploits that only require receiving/downloading emails, but no user interaction, the company is willing to pay up to $200,000. Zerodium says it may also acquire exploits that require opening/reading an email, but for a lower reward.
The company has yet to announce when these limited time offers will end.
Related: Zerodium Buying Zero-Day Exploits Targeting VPN Software
Related: Zerodium Offers $100,000 for Pidgin Zero-Day Exploits
Related: Zerodium Offers $500,000 for VMware ESXi, Microsoft Hyper-V Exploits

More from Ionut Arghire
- Blackpoint Raises $190 Million to Help MSPs Combat Cyber Threats
- ‘Asylum Ambuscade’ Group Hit Thousands in Cybercrime, Espionage Campaigns
- Google Cloud Now Offering $1 Million Cryptomining Protection
- Pharmaceutical Giant Eisai Takes Systems Offline Following Ransomware Attack
- North Korean Hackers Blamed for $35 Million Atomic Wallet Crypto Theft
- Cisco Patches Critical Vulnerability in Enterprise Collaboration Solutions
- Android’s June 2023 Security Update Patches Exploited Arm GPU Vulnerability
- US, Israel Provide Guidance on Securing Remote Access Software
Latest News
- In Other News: AI Regulation, Layoffs, US Aerospace Attacks, Post-Quantum Encryption
- Blackpoint Raises $190 Million to Help MSPs Combat Cyber Threats
- Google Introduces SAIF, a Framework for Secure AI Development and Use
- ‘Asylum Ambuscade’ Group Hit Thousands in Cybercrime, Espionage Campaigns
- Evidence Suggests Ransomware Group Knew About MOVEit Zero-Day Since 2021
- SaaS Ransomware Attack Hit Sharepoint Online Without Using a Compromised Endpoint
- Google Cloud Now Offering $1 Million Cryptomining Protection
- Democrats and Republicans Are Skeptical of US Spying Practices, an AP-NORC Poll Finds
