# New attack turned Microsoft 365 Copilot into 1-click data theft tool

> **Open Intelligence Dossier** · First detected: 2026-06-15 17:07 UTC · Category: Technology

## Executive Summary
A critical vulnerability identified as SearchLeak allowed unauthorized access to sensitive data within Microsoft 365 Copilot.

## Intelligence Brief
A flaw termed SearchLeak enabled attackers to execute one-click data theft through Microsoft 365 Copilot. The vulnerability allowed for the extraction of emails, files, and multi-factor authentication codes.


Coverage from The Hacker News, BleepingComputer, and The420.in highlights that the flaw impacted the functionality of the 365 Copilot suite. Reports confirm that Microsoft has issued a patch to address the security vulnerability.


Future developments depend on user implementation of the provided patch. Coverage does not yet specify whether unauthorized data exfiltration occurred before the security update was deployed.

## Multi-Source Evidence Table
| Source Outlet | Headline | Verification URL |
|---|---|---|
| The420.in | Microsoft Patches Critical SearchLeak Flaw in 365 Copilot | [Source Link](https://news.google.com/rss/articles/CBMihgFBVV95cUxOUTFIQzJ4WFp4MjZKZ2ZNTmlWbE01WEpBM2ZtSEZrYkZZMF9POUF0TzNhd2s5aEhMNkRpTVpnd01OQnF6QkpIUXBCbnQ5cThub3JZRlYzd0FobF9iN29zMkdfREx6UmY0ODRtTzJ5RFY1cjAyNDVLYWJ1cHBuUkJlR2NvQzJJUQ?oc=5) |
| The Hacker News | One-Click Microsoft 365 Copilot Flaw Could Have Let Attackers Steal Emails, Files, and MFA Codes | [Source Link](https://news.google.com/rss/articles/CBMigAFBVV95cUxNRVRTVXRfVW45UlJ3YjlkdzJSVVpNTFVPeXBMdUhNTjdGdU9VdVZ4QVNxankyWXUxTVZsaEVqLXV1MTR6ZUxrNXZBOVI3eE9fWjJvNWdwM3pIZUtuYVhMTnB3bWhGTFl4QmJXak5EZzY5ZG56bEtKRThCS0oxSU5ucw?oc=5) |
| BleepingComputer | New attack turned Microsoft 365 Copilot into 1-click data theft tool | [Source Link](https://news.google.com/rss/articles/CBMitwFBVV95cUxOT3hxN0FSMUtXdVkxZXVNOFhna2lHdXBxS18zeFpLS0ExWm56VjFzc2JMT2Fqam9KbWY2TjBZMmVaSzI1LWN2UG5BYXA0WFQ2QzAzeEx5S0lHUW96ellaMWpib2poMTBEaTJNSW9seDVNNjlOazBTdmZiUzd3ak5KNnNycGJ6aGhUaG5IVnJYYUZuNDZEMXR3MmNBenVrazlKdUJxS1l2UjhxT01icUp5a2VjOWNwY2PSAbwBQVVfeXFMTzVLZDlUeHpHaTlVRW9BNVg4QzZkbEp6YTVpOVdxSm1DSlpQWDhRSk1VYTVXOGVtdXZmM0hMRGdlOWxaZTVWS3VLY0s0NUlXOVVrOHpPc0FSTUh2QnlKMVVCdUxId1o2alVSbEwxa1lyNFFTZEpvbm0xYXhJc1FVZFBxSEFxWUkxLWszVGJTbmc2RlJUdVRNeFM3cTF) |

---
*Canonical Source: https://pulse.byoviral.com/trend/2026-06-15/new-attack-turned-microsoft-365-copilot-into-1-click-data-theft-tool*