A Microsoft Outlook add-in was abandoned and taken over by hackers, who used it to collect email accounts and banking data.