Microsoft's M365 Copilot critical flaw allows 2FA code theft via SearchLeak exploit
A new prompt injection attack steals 2FA codes by abusing Bing image requests
Deep Dive
Microsoft patched a max-critical vulnerability in M365 Copilot after researchers at Varonis revealed their SearchLeak exploit. The attack uses parameter-to-prompt injection in a crafted email URL to force Copilot to search emails and exfiltrate sensitive data (including 2FA codes) via Bing image requests, bypassing output guardrails. The root cause: LLMs cannot distinguish user instructions from injected commands in third-party content. Microsoft fixed the specific vulnerabilities but the underlying issue remains unsolved.
Key Points
- Microsoft patched a CVSS 9.8 critical vulnerability in M365 Copilot that allowed prompt injection via email URLs
- Varonis' SearchLeak exploit uses parameter-to-prompt injection to make Copilot search emails and exfiltrate data (e.g., 2FA codes) via Bing image requests
- Guardrails fail because the browser renders raw HTML before the <code> wrapping occurs, and Bing is a permitted domain for external requests
Why It Matters
Enterprises using M365 Copilot must patch immediately as AI agents become prime vectors for data exfiltration.