Researchers disclosed a critical Microsoft Copilot (personal) vulnerability chain that could let an attacker steal enterprise data by getting a user to open a legitimate-looking link or summarize a crafted webpage. The attack abuses Copilot features (auto-running prompts, connected-app access, and web summarization) to pull data from services like Gmail/OneDrive and send it to an attacker-controlled webhook, with little to no obvious user warning.
This disclosed exploit chain against Microsoft Copilot (personal) relied on getting a user to open a legitimate-looking link or have Copilot summarize a crafted webpage. Researchers described the core exploit pattern simply: one click on a legitimate-looking link is enough. A URL parameter, combined with an undocumented parameter, could cause an attacker-supplied prompt to execute instantly on page load, with no click, confirmation, or additional user action needed once the link was opened.
Once triggered, the injected prompt could query the victim's connected apps, including Gmail, Drive, Calendar, or OneDrive, encode the results into a URL, and exfiltrate them via Copilot's built-in URL-fetch capability to an attacker-controlled webhook. A second scenario involved a crafted webpage that, when summarized by Copilot, wrote attacker instructions directly into the victim's permanent memory store rather than requiring repeat clicks.
The chain succeeded because it exploited trust in ordinary-looking actions: clicking a link or asking an AI assistant to summarize a page. Neither action typically raises suspicion for employees or executives. The automation built into Copilot, meant to streamline access to connected apps and content summarization, removed the usual friction points (approval prompts, visible warnings) that might otherwise alert a user that something unusual was happening.
The persistence mechanism made the issue harder to contain. The injection reportedly survived password changes, session revocation, and device re-enrollment, meaning that every standard incident response step could leave the injection intact.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A URL parameter combined with an undocumented parameter could cause an attacker-supplied prompt to execute instantly when a page loaded, with no click, confirmation, or user action required beyond opening the link.
An injected prompt could query connected apps such as Gmail, Drive, Calendar, or OneDrive, then exfiltrate the results via Copilot's built-in URL-fetch capability to an attacker-controlled webhook.
Yes. A crafted webpage summarized by Copilot could inject instructions into the victim's permanent memory store, and researchers noted this persisted through password changes, session revocation, and device re-enrollment.
Microsoft labeled the issue critical, tracked as CVE-2026-24301, and stated that customers were already protected after patching.
With CoSnitch, one click on a legit‑looking link is enough for Copilot to start leaking your data. That link can auto‑run a hidden Copilot prompt via a ?q= parameter, no extra click, no confirmation, then quietly pull from Gmail, Drive, Calendar, or OneDrive and send it to a webhook. Worse, if you ask Copilot to summarize a crafted webpage, it can write hidden instructions into Copilot’s permanent memory that survive password changes and session revokes. If a link or page makes Copilot act on its own, stop and report it, do not trust or reuse that link, and flag the behavior to security immediately.
Microsoft observed real-world campaigns where victims were tricked by “ClickFix” prompts into pasting a command into Windows Run, which then installed ACR (Amatera) Stealer. The malware steals saved browser passwords, live session tokens, and Microsoft 365/OneDrive/SharePoint files, meaning…
Researchers showed how an attacker could trick Microsoft Copilot into running a malicious prompt automatically just by getting a user to click a specially crafted link. The prompt can then make Copilot search connected accounts (like email and cloud storage) and send information to an external…
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
Researchers described a now-patched flaw ("AgentForger") where a single benign-looking ChatGPT link could silently create and publish an attacker-controlled Workspace Agent inside a company. If an employee was already logged in and had connected apps (like email, Drive, Slack, or Teams), the agent…
Cofense observed a real phishing campaign impersonating Google Ads Sync Accounts (MMC) with a fake “maintenance/system upgrade” notice. The email pressures recipients to click “Complete Sync Account,” sending them through lookalike sites and a fake Google sign-in pop-up that captures credentials.…
The article describes how attackers use QR codes in emails (“quishing”) to hide malicious links, push victims onto less-protected mobile phones, and steal credentials or MFA tokens. It also cites an FBI notice describing North Korea’s Kimsuky using QR codes in spearphishing emails targeting think…
