Loading story…
Varonis Threat Labs disclosed SearchLeak, a critical exploit chain in Microsoft 365 Copilot Enterprise Search that could let an attacker steal sensitive enterprise data after a user clicked a single trusted microsoft.com link. Microsoft tracked the issue as CVE-2026-42824 and remediated it on the backend. According to the researchers, the attack could expose data available through the victim’s Microsoft Graph permissions, including emails, calendar entries, meeting notes, SharePoint content, OneDrive files, and potentially MFA-related messages, though no in-the-wild exploitation was reported.
The technique chained three weaknesses: parameter-to-prompt injection through the Copilot Search q parameter, an HTML streaming race condition that allowed an injected image tag to render before sanitization, and abuse of a Bing allowlist in Content Security Policy to exfiltrate the retrieved data through Bing’s server-side image fetch behavior. Researchers said the attack required no plugins, elevated privileges, or second user interaction, highlighting how AI prompt injection can revive older web security flaws in enterprise platforms. Microsoft rated the flaw critical, while public severity scoring differed across sources, and defenders were advised to watch for suspicious Copilot Search URLs containing encoded or HTML payloads and unusual Bing image endpoint traffic.
Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft remediated the SearchLeak issue on the backend and assigned it CVE-2026-42824, rating it critical. Reporting also noted differing severity scores between Microsoft and the National Vulnerability Database, and that no in-the-wild exploitation was observed.
Varonis Threat Labs disclosed SearchLeak, a one-click exploit chain affecting Microsoft 365 Copilot Enterprise Search that could exfiltrate sensitive enterprise data accessible to the victim. The research described a chain involving parameter-to-prompt injection, an HTML rendering race condition, and Bing-based SSRF-assisted exfiltration.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
9 references tracked. Mallory keeps watching after this page renders.
csoonline.com
Open sourcepivot-to-ai.com
Open sourcexakep.ru
Open sourcearstechnica.com
Open sourcescworld.com
Open sourcethehackernews.com
Open sourcereddit.com
Open sourcevaronis.com
Open sourcedarkreading.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed **CVE-2025-32711**, a critical information disclosure flaw in **Microsoft 365 Copilot** that researchers later detailed as **EchoLeak**, describing it as the first reported real-world **zero-click prompt injection** exploit in a production LLM system. The vulnerability carried a **CVSS 9.3** rating and allowed a remote, unauthenticated attacker to exfiltrate sensitive data over the network without user interaction, reportedly by sending a single crafted email that Copilot would process. Research describing the exploit said the attack chained multiple bypasses across LLM trust boundaries, including evasion of Microsoft’s XPIA classifier, use of reference-style Markdown to bypass link redaction, auto-fetched images, and abuse of a Microsoft Teams proxy allowed by content security policy to extract data. Microsoft said the issue had already been fully mitigated in the cloud service and required no customer action, while the broader research and follow-on reporting framed the incident as evidence that prompt injection and "AIjacking" can enable full data exfiltration in enterprise copilots unless controls such as prompt partitioning, stronger filtering, provenance-based access control, stricter CSPs, least privilege, and continuous adversarial testing are in place.
Jun 29, 2026
Researchers disclosed **CVE-2026-32193**, a Microsoft Copilot hijack that abused an undocumented URL parameter, `?autorun=1`, to bypass the normal user-approval step and automatically run attacker-supplied prompts. By pairing that parameter with crafted input in the `q` field, an attacker could make Copilot operate within a victim’s authenticated session, search connected enterprise data including inbox contents, and send sensitive results to an attacker-controlled server. The attack could be delivered through phishing links, chat messages, webpages, or QR codes, and researchers reported it could continue even if the victim closed the Copilot tab immediately after opening it. Separate reporting tied the issue to a broader attack chain described as moving from an **AKS node root vulnerability** to a Copilot compromise, underscoring how cloud and AI weaknesses can be chained together. Researchers also described a second prompt-injection method that poisoned Copilot’s persistent memory using hidden webpage metadata, allowing later manipulation of Copilot responses and actions. The disclosures highlight risks from undocumented AI features, prompt injection, and trusted-session abuse in enterprise copilots connected to corporate data.
Aug 21, 2026
Researchers reported that vulnerabilities in Microsoft 365 Copilot and Consumer Copilot allowed attackers to turn prompt injection into data exfiltration, memory poisoning, and persistent compromise. Microsoft assigned `CVE-2026-24299` to the main issue set and rolled out fixes across late 2025 and early 2026, while a related Microsoft Excel flaw, `CVE-2026-26144`, showed how a conventional application bug could be chained with Copilot Agent mode to silently extract spreadsheet data. In the Copilot attacks, malicious content abused HTML preview rendering to leak sensitive information through external requests, first with CSS background images and later with `@font-face`, and researchers said users could be coerced into triggering the preview during normal interaction, creating a near zero-click exfiltration path. The research also showed that Copilot’s memory features could be poisoned to add or delete stored facts and implant persistent instructions that altered future sessions, enabling a backdoor dubbed **SpAIware** that continued leaking secrets over time. Similar issues were described in consumer Copilot, including durable-memory manipulation and browser-navigation exfiltration through Edge-integrated tooling. The findings underscore a broader security shift: AI assistants can collapse trust boundaries inside host applications, raising the impact of older flaws and forcing defenders to reassess assistant permissions, restrict outbound network access from AI-enabled apps, and separately monitor AI-initiated network activity.
Jun 29, 2026