The exploit acquisition firm Zerodium this week showed increased interest in buying zero-day exploits targeting the popular email clients Microsoft Outlook and Mozilla Thunderbird.
The company was already looking to acquire Microsoft Outlook zero-day exploits, but this week it announced higher maximum payouts for them, up from $250,000 to $400,000, yet only temporarily.
“We are looking for zero-click exploits leading to remote code execution when receiving/downloading emails in Outlook, without requiring any user interaction such as reading the malicious email message or opening an attachment,” the company says.
Zerodium is also willing to pay for exploits that require user interaction, such as opening and reading an email, but says it will pay less for those.
The company’s announcement comes the same day a Trustwave researcher disclosed details of a new method of bypassing an Outlook security feature to deliver malicious links to victims. Microsoft addressed the bypass in the summer of 2021.
This week, Zerodium also announced its interest in acquiring zero-day exploits targeting Thunderbird and leading to remote code execution.
For exploits that only require receiving/downloading emails, but no user interaction, the company is willing to pay up to $200,000. Zerodium says it may also acquire exploits that require opening/reading an email, but for a lower reward.
The company has yet to announce when these limited time offers will end.
Related: Zerodium Buying Zero-Day Exploits Targeting VPN Software
Related: Zerodium Offers $100,000 for Pidgin Zero-Day Exploits
Related: Zerodium Offers $500,000 for VMware ESXi, Microsoft Hyper-V Exploits

More from Ionut Arghire
- Organizations Worldwide Targeted in Rapidly Evolving Buhti Ransomware Operation
- Google Cloud Users Can Now Automate TLS Certificate Lifecycle
- NCC Group Releases Open Source Tools for Developers, Pentesters
- Memcyco Raises $10 Million in Seed Funding to Prevent Website Impersonation
- Apria Healthcare Notifying 2 Million People of Years-Old Data Breaches
- European Cybersecurity Firm Sekoia.io Raises $37.5 Million
- GitLab Security Update Patches Critical Vulnerability
- Android App With 50,000 Downloads in Google Play Turned Into Spyware via Update
Latest News
- Industrial Giant ABB Confirms Ransomware Attack, Data Theft
- Organizations Worldwide Targeted in Rapidly Evolving Buhti Ransomware Operation
- Google Cloud Users Can Now Automate TLS Certificate Lifecycle
- Zyxel Firewalls Hacked by Mirai Botnet
- Watch Now: Threat Detection and Incident Response Virtual Summit
- NCC Group Releases Open Source Tools for Developers, Pentesters
- Memcyco Raises $10 Million in Seed Funding to Prevent Website Impersonation
- New Russia-Linked CosmicEnergy ICS Malware Could Disrupt Electric Grids
