Loading story…
Security researchers disclosed Reprompt, a single-click attack against Microsoft Copilot Personal that enabled stealthy exfiltration of sensitive user data by abusing a legitimate Copilot URL containing a malicious q parameter. After a victim clicks the link (typically delivered via phishing), the crafted URL triggers Parameter-to-Prompt (P2P) injection, auto-executing attacker-controlled prompts within the victim’s authenticated Copilot session; researchers reported the attacker can maintain control and continue querying data even after the Copilot window/tab is closed. Microsoft has patched the issue.
Varonis Threat Labs described an attack chain that combines three techniques to bypass Copilot’s guardrails and evade detection: P2P injection (prompt injection via the q parameter on page load), Double-Request (leveraging the observation that leak protections may apply to the first request but not a repeated action), and Chain-Request (server-driven, sequential follow-up prompts that adapt based on prior responses). Reported exposed data includes personally identifiable information (PII) and other Copilot-accessible context such as conversation memory and user details (e.g., location and activity/history), with the staged prompting designed to appear benign while progressively leaking information to attacker-controlled infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
In response to the disclosure, Microsoft stated that Microsoft 365 Copilot enterprise customers were not impacted by the vulnerability. Coverage said enterprise protections and the pre-disclosure patching meant the issue did not affect those users.
On public disclosure, Varonis described a multistage attack chain using Parameter-to-Prompt injection, a double-request guardrail bypass, and chained follow-on prompts to exfiltrate sensitive Copilot chat data after a single click. Reports said the issue affected Microsoft Copilot Personal, could persist after the chat window was closed, and that no in-the-wild exploitation had been observed.
Microsoft fixed the Reprompt vulnerability before public disclosure, with multiple reports tying the remediation to the January 2026 Patch Tuesday release. The patch was released on Patch Tuesday, preventing the disclosed one-click attack chain against affected Copilot users.
Varonis Threat Labs responsibly disclosed a one-click data-exfiltration issue in Microsoft Copilot to Microsoft. The report said the attack abused the Copilot "q" URL parameter to inject prompts and hijack an authenticated session.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcethehackernews.com
Open sourcemalwarebytes.com
Open sourcearstechnica.com
Open sourcecybersecuritynews.com
Open sourcezdnet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Varonis Threat Labs disclosed a prompt-injection attack chain dubbed **Reprompt** that enabled one-click data theft from **Microsoft Copilot** by abusing how Copilot accepts prompts via a URL. The technique relied on the `q` URL parameter to auto-populate and execute attacker-supplied instructions when a victim clicked a crafted Copilot link, requiring no plugins, connectors, or additional user-entered prompts. Researchers reported the method could expose sensitive information previously available in the Copilot session, including **PII**, and could continue exfiltration even after the Copilot chat window was closed. The reported attack flow chained multiple techniques to bypass Copilot’s protections, including **Parameter-to-Prompt (P2P) injection** via the `q` parameter and a **double-request bypass** in which safeguards applied to an initial request but could be defeated by forcing Copilot to repeat the task, leading to disclosure on a subsequent attempt. Varonis also described **chain-request exfiltration** to maintain covert control of the session and progressively extract data. Reporting indicates Microsoft took action in response to the research, though the core risk highlighted is that URL-triggered prompt execution and multi-step request chaining can undermine AI assistant guardrails if not consistently enforced across requests and session states.
Jun 29, 2026
Researchers reported that vulnerabilities in Microsoft 365 Copilot and Consumer Copilot allowed attackers to turn prompt injection into data exfiltration, memory poisoning, and persistent compromise. Microsoft assigned `CVE-2026-24299` to the main issue set and rolled out fixes across late 2025 and early 2026, while a related Microsoft Excel flaw, `CVE-2026-26144`, showed how a conventional application bug could be chained with Copilot Agent mode to silently extract spreadsheet data. In the Copilot attacks, malicious content abused HTML preview rendering to leak sensitive information through external requests, first with CSS background images and later with `@font-face`, and researchers said users could be coerced into triggering the preview during normal interaction, creating a near zero-click exfiltration path. The research also showed that Copilot’s memory features could be poisoned to add or delete stored facts and implant persistent instructions that altered future sessions, enabling a backdoor dubbed **SpAIware** that continued leaking secrets over time. Similar issues were described in consumer Copilot, including durable-memory manipulation and browser-navigation exfiltration through Edge-integrated tooling. The findings underscore a broader security shift: AI assistants can collapse trust boundaries inside host applications, raising the impact of older flaws and forcing defenders to reassess assistant permissions, restrict outbound network access from AI-enabled apps, and separately monitor AI-initiated network activity.
Jun 29, 2026
Varonis Threat Labs disclosed **SearchLeak**, a critical exploit chain in Microsoft 365 Copilot Enterprise Search that could let an attacker steal sensitive enterprise data after a user clicked a single trusted `microsoft.com` link. Microsoft tracked the issue as **`CVE-2026-42824`** and remediated it on the backend. According to the researchers, the attack could expose data available through the victim’s Microsoft Graph permissions, including emails, calendar entries, meeting notes, SharePoint content, OneDrive files, and potentially MFA-related messages, though no in-the-wild exploitation was reported. The technique chained three weaknesses: **parameter-to-prompt injection** through the Copilot Search `q` parameter, an **HTML streaming race condition** that allowed an injected image tag to render before sanitization, and abuse of a **Bing allowlist** in Content Security Policy to exfiltrate the retrieved data through Bing’s server-side image fetch behavior. Researchers said the attack required no plugins, elevated privileges, or second user interaction, highlighting how AI prompt injection can revive older web security flaws in enterprise platforms. Microsoft rated the flaw critical, while public severity scoring differed across sources, and defenders were advised to watch for suspicious Copilot Search URLs containing encoded or HTML payloads and unusual Bing image endpoint traffic.
Jun 29, 2026