Loading story…
A security researcher demonstrated a tool called EDV that forwards Windows Sysmon telemetry to Microsoft Copilot Chat and asks the assistant to classify each event as either ALERT or OK. The prototype uses Sysmon event data collected from Windows hosts and interacts with the built-in Windows Copilot progressive web app over HTTP and WebSocket connections to submit prompts for binary maliciousness assessment.
In testing, Copilot identified roughly 40% of evaluated LOLBAS activity that Microsoft Defender had not blocked and also flagged some suspicious administrative actions, including adding a user to the Domain Admins group. The researcher also reported both false positives and false negatives, including benign DNS-related alerts, and concluded the approach is not suitable for production detection despite showing that Copilot could sometimes surface potentially malicious behavior missed by Defender.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
Claudio Contin published a write-up describing the EDV experiment and its results, including how Copilot Chat was used to assess Sysmon events for potential maliciousness.
During testing against LOLBAS activity and PowerShell behaviors with Defender enabled, Copilot marked roughly 40% of tested LOLBAS events not blocked by Defender as malicious and also flagged actions such as adding a user to the Domain Admins group. The researcher also observed false positives and false negatives and concluded the approach was not suitable for production use.
In the experiment, the researcher enabled Sysmon on a Windows test host, used the SwiftOnSecurity Sysmon configuration, and developed the EDV tool to query Sysmon events and submit them to Microsoft Copilot Chat over HTTP and WebSocket.
Microsoft provides Sysmon as a Sysinternals utility that logs detailed system activity to the Windows event log, forming the telemetry source used in the later experiment.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
tierzerosecurity.co.nz
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
New reporting highlighted a **prompt-injection phishing risk** in Microsoft Copilot after Permiso researchers found that attacker-controlled text embedded in emails could manipulate Copilot-generated summaries through cross-prompt injection attacks. The issue could cause Copilot to present deceptive security alerts or malicious instructions inside a trusted Microsoft 365 interface, increasing the likelihood that users will believe and act on attacker content. Separate coverage also noted broader security and privacy concerns around Microsoft’s AI ecosystem, including criticism of Windows Recall for capturing and storing snapshots of user activity that Copilot can analyze, even after Microsoft added stronger protections following earlier backlash. Microsoft also faced continued scrutiny over how aggressively it is pushing Copilot into user environments. The company temporarily halted plans to **automatically install the Microsoft 365 Copilot app** on eligible Windows systems outside the EEA, though existing installations remain in place and administrators can still deploy it manually. Public criticism of Copilot’s quality and Microsoft’s AI strategy also spilled into the company’s Discord community, where moderation actions against users mocking “Microslop” drew further attention to dissatisfaction with rushed AI integration, privacy concerns, and the perception that Microsoft is forcing AI features into products despite unresolved trust and security issues.
Jun 29, 2026
Security researchers reported two distinct Microsoft Copilot-related risks: (1) **cross prompt injection** against *Microsoft Copilot* email summarization surfaces that can cause attacker-supplied text in an email to be treated like instructions, shaping the summary into a convincing in-product “security alert” and creating a phishing path that does not rely on attachments or macros; and (2) **audit-logging gaps in Microsoft Copilot Studio** where certain administrative actions for Copilot Studio agents (e.g., around sharing, authentication, logging, and publication) were not consistently recorded in Microsoft 365’s Unified Audit Log, potentially reducing defenders’ ability to detect malicious or unauthorized agent changes. Permiso described how Copilot’s behavior varies across Outlook’s inline *Summarize* experience, the Outlook Copilot pane/add-in, and Teams-based summarization, with the core risk being **trust transfer**—users may treat Copilot output as system-generated even when it is attacker-influenced—and warned that retrieval across Microsoft 365 (Teams/OneDrive/SharePoint) could amplify impact if chained. Datadog Security Labs stated it reported Copilot Studio logging issues to **MSRC**, that Microsoft remediated logging for the affected events by **October 5, 2025**, and that Datadog later observed a **regression** where some events again failed to log consistently, which it also reported to Microsoft.
Jun 29, 2026
Security researchers disclosed attacks against Microsoft Copilot that use prompt injection and chained requests to extract sensitive data with minimal user interaction. Varonis Threat Labs described a **single-click** technique called **Reprompt** against **Microsoft Copilot Personal** that abuses legitimate Copilot links with a prefilled `q` parameter, then uses a **double-request** and **chain-request** flow to hide exfiltration instructions on an attacker-controlled server. The report said the attack could continue pulling data from an active session even after the Copilot tab was closed, while evading many client-side monitoring tools; Microsoft said the issue had been patched, and Varonis reported that **Microsoft 365 Copilot enterprise customers were not affected**. A separate report from **Rubrik Zero Labs** said it had **broken the Microsoft 365 Copilot sandbox** in research published under the title *ChatMate*, indicating continued scrutiny of Copilot’s isolation and data-protection boundaries across Microsoft’s AI offerings. Together, the disclosures highlight how trusted Copilot workflows, prefilled prompts, and multi-step prompt handling can be abused to bypass intended safeguards and expose user data, reinforcing the need to treat AI prompt inputs and follow-on actions as untrusted.
Aug 12, 2026