TLDR Tech / InfoSec
New attack turned Microsoft 365 Copilot into 1-click data theft tool
Varonis researchers chained a parameter-to-prompt injection, an HTML rendering race condition, and a Bing SSRF-driven CSP bypass into SearchLeak (CVE-2026-42824, critical), a one-click attack that let a crafted URL direct Microsoft 365 Copilot Enterprise Search to pull mailbox, OneDrive, and SharePoint data and exfiltrate it through a Bing image fetch, since patched by Microsoft with no user action required.
Read the full story