TLDR Tech / InfoSec
SearchLeak: How We Turned M365 Copilot Into a One-Click Data Exfiltration Weapon
Varonis Threat Labs found a three-stage bug chain in Microsoft 365 Copilot Enterprise Search that lets an attacker steal data with a single malicious link. The q URL parameter is treated as an instruction, so Copilot can be tricked into searching a victim's email, calendar, SharePoint, and OneDrive, then embedding results inside an image URL. While Copilot streams its answer, an injected image tag briefly renders before sanitization and triggers a request to Bing's image search endpoint, which fetches an attacker-controlled URL containing the stolen data. Microsoft fixed the issue as CVE-2026-42824, but the technique shows how AI-powered search can turn old web bugs into practical data-exfiltration paths.
Read the full story