#4
BleepingComputer
general
June 15, 2026 at 13:00 UTC
New attack turned Microsoft 365 Copilot into 1-click data theft tool
By Bill Toulas
AI Summary
Varonis Threat Labs disclosed 'SearchLeak,' a three-bug chain in Microsoft 365 Copilot Enterprise that allowed a single click on a legitimate microsoft.com URL to exfiltrate emails, OneDrive files, SharePoint content, and MFA codes. The attack exploited trusted domain infrastructure, bypassing standard URL filtering and anti-phishing controls; the vulnerability has since been patched by Microsoft.
Relevance score: 83.0/100
Sponsored
Protect Your Business
Expert cybersecurity solutions to safeguard your organization from evolving threats.
Get Protected →