New attack turned Microsoft 365 Copilot into 1-click data theft tool
A critical vulnerability identified as SearchLeak allowed unauthorized access to sensitive data within Microsoft 365 Copilot.
🌍 Cross-language spread
This story first appeared in 🇩🇪 German coverage — 4.1 hours before PULSE detected it in English news.
Detected by matching proper nouns and figures that survive translation. Times reflect when each edition's coverage was first indexed.
Velocity
How fast coverage is spreading — measured hourly from article rate × source diversity. How this works →
The brief
A flaw termed SearchLeak enabled attackers to execute one-click data theft through Microsoft 365 Copilot. The vulnerability allowed for the extraction of emails, files, and multi-factor authentication codes.
Coverage from The Hacker News, BleepingComputer, and The420.in highlights that the flaw impacted the functionality of the 365 Copilot suite. Reports confirm that Microsoft has issued a patch to address the security vulnerability.
Future developments depend on user implementation of the provided patch. Coverage does not yet specify whether unauthorized data exfiltration occurred before the security update was deployed.
Synthesized by PULSE from the headlines below under a strict no-invention contract. Updated 62d ago.
Quick answers
What was the name of the security flaw?
The vulnerability is identified as SearchLeak.
What information could be accessed using the flaw?
Attackers could potentially access emails, files, and MFA codes.
Has the issue been resolved?
Yes, Microsoft has patched the critical flaw in 365 Copilot.
Coverage (3)
- Microsoft Patches Critical SearchLeak Flaw in 365 Copilot The420.in · 64d ago
- One-Click Microsoft 365 Copilot Flaw Could Have Let Attackers Steal Emails, Files, and MFA Codes The Hacker News · 64d ago
- New attack turned Microsoft 365 Copilot into 1-click data theft tool BleepingComputer · 64d ago
Topics
Related trends
Microsoft confirms outage affecting search in Microsoft 365 apps
Microsoft has confirmed a widespread service outage disrupting search functionality across several core Microsoft 365 applications.
Vineland planning board votes to approve Phase 2 of controversial data center
The Vineland planning board has approved Phase 2 of a controversial 300-megawatt data center, clearing a critical hurdle for a Nebius deal with Microsoft.
OpenAI to rewrite its safety rules post-Hugging Face
OpenAI is overhauling its safety protocols and slowing model development following reports of rogue AI agents and hacking incidents.
Microsoft Copilot reveals secret input that allowed it to be hacked
Security researchers have exposed a secret input in Microsoft Copilot that allows hackers to exfiltrate data and potentially monetize single logins.
Microsoft admits Windows 11 context menus are sluggish, announces major improvements
Microsoft is introducing a customizable, faster context menu for Windows 11 to address long-standing sluggishness and clutter issues.
AI hasn’t gone rogue. It’s worse than that
Recent reports from Financial Times and SecurityWeek highlight systemic risks in AI integration, focusing on a specific naming error that enabled model attacks.