Loading story…
Barracuda Networks researchers demonstrated a proof-of-concept attack showing how email-integrated AI assistants such as Microsoft Copilot could amplify business email compromise after a single mailbox is breached. In the simulated intrusion, attackers used the assistant to create stealthy inbox rules, map internal relationships, summarize sensitive threads, and mimic a user’s writing style, allowing them to conduct reconnaissance and launch convincing internal phishing from a legitimate account.
The attack chain escalated from an employee mailbox to the CEO’s account by capturing the executive’s session token through an adversary-in-the-middle proxy, bypassing MFA and giving the attackers control of the real mailbox. From there, the CEO’s AI assistant was used to identify a legitimate pending wire transfer—reported in one scenario as $247,500—and generate fraudulent payment instructions redirecting funds to an attacker-controlled bank account, while forwarding or deleting messages to conceal the fraud; researchers warned that the risk extends beyond Copilot to any AI assistant with inbox access.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Barracuda researchers conducted a simulated proof-of-concept attack showing how an attacker with access to one employee mailbox could abuse an email AI assistant such as Microsoft Copilot to hide alerts, reconnoiter internal relationships, phish the CEO through an adversary-in-the-middle link, steal a session token to bypass MFA, and then use the CEO mailbox to redirect a legitimate pending wire transfer. The research was presented as a warning that AI assistants with inbox access could amplify business email compromise and financial fraud after initial mailbox compromise.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft detected an AI-assisted business email compromise and invoice-fraud campaign that sent more than one million emails from August 3–5, primarily targeting U.S. enterprise users. The attackers impersonated executives at victim organizations and **ServiceNow**, targeting accounts-payable personnel with fabricated invoices and forged email threads intended to prompt ACH transfers of nearly **$50,000**. The campaign used third-party email-delivery accounts and newly registered lookalike domains to make the payment requests appear legitimate. Microsoft found no evidence that ServiceNow or any other organization impersonated in the lures had been compromised or participated in the activity. Campaign artifacts indicated AI-assisted development of phishing templates, though Microsoft could not conclusively determine the extent to which AI generated the messages; organizations should ensure anti-phishing controls and automated attack-disruption capabilities in Microsoft Defender XDR are configured to contain comparable BEC activity.
Sep 14, 2026
Researchers disclosed **CVE-2026-32193**, a Microsoft Copilot hijack that abused an undocumented URL parameter, `?autorun=1`, to bypass the normal user-approval step and automatically run attacker-supplied prompts. By pairing that parameter with crafted input in the `q` field, an attacker could make Copilot operate within a victim’s authenticated session, search connected enterprise data including inbox contents, and send sensitive results to an attacker-controlled server. The attack could be delivered through phishing links, chat messages, webpages, or QR codes, and researchers reported it could continue even if the victim closed the Copilot tab immediately after opening it. Separate reporting tied the issue to a broader attack chain described as moving from an **AKS node root vulnerability** to a Copilot compromise, underscoring how cloud and AI weaknesses can be chained together. Researchers also described a second prompt-injection method that poisoned Copilot’s persistent memory using hidden webpage metadata, allowing later manipulation of Copilot responses and actions. The disclosures highlight risks from undocumented AI features, prompt injection, and trusted-session abuse in enterprise copilots connected to corporate data.
Aug 21, 2026
Security researchers have identified two distinct attack techniques targeting Microsoft's AI-powered platforms. The first, dubbed **CoPhish**, leverages Microsoft Copilot Studio agents to deliver fraudulent OAuth consent requests through legitimate Microsoft domains, enabling attackers to steal OAuth tokens. By customizing Copilot Studio chatbots and exploiting the platform's "demo website" feature, attackers can trick users into authenticating with malicious applications, potentially granting unauthorized access to sensitive resources. Microsoft has acknowledged the issue and is working on product updates to mitigate the risk, emphasizing the need for organizations to strengthen governance and consent processes. Separately, a vulnerability in Microsoft 365 Copilot was discovered that allowed attackers to use indirect prompt injection via Mermaid diagrams to exfiltrate sensitive tenant data, such as emails. By embedding malicious instructions in seemingly benign prompts, attackers could manipulate Copilot to retrieve and encode confidential information. Although Microsoft has since patched this flaw, the incident highlights the emerging risks associated with integrating AI assistants and third-party tools, as well as the challenges in securing complex, automated workflows within enterprise environments.
Jul 12, 2026