A Copilot Flaw Lets One Click Steal Inboxes, Files, and MFA Codes

Microsoft bolted Copilot into enterprise search, and researchers at Varonis turned the bolt into a back door, chaining three flaws into an attack they call SearchLeak. The chain allows an attacker to steal sensitive data, MFA codes, email messages, meeting details, and private organizational files, with a single click. The whole heist rides a real microsoft.com link, so because the link pointed to a real microsoft.com domain, traditional anti-phishing and URL filtering tools were unlikely to flag it, and the victim sees nothing but Copilot thinking. Microsoft patched the hole and rated it critical, which is corporate for “the helpful assistant was also the burglar.” See BleepingComputer on the SearchLeak attack.