Microsoft Outlook, especially for Office365, IS a flaw.
Outlook is a security mess.
I’m surprised any major company uses it
I am at the point that I will use ANYTHING except Google.
Google, from top to bottom, is the essence of evil, IMO.
And it is what I am forced to use at work right now.
For further details on what Microsoft found, check out:
HAFNIUM targeting Exchange Servers with 0-day exploits
Microsoft Threat Intelligence Center (MSTIC)
Microsoft 365 Defender Threat Intelligence Team
Microsoft 365 Security
https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/