New attack turned Microsoft 365 Copilot into 1-click data theft tool

Varonis Threat Labs has disclosed three vulnerabilities in Microsoft Copilot Personal that it said could allow a single click on a crafted link to silently pull data from

&#32; submitted by &#32; <a href="https://www.reddit.com/user/ImpressiveFudge2350"> /u/ImpressiveFudge2350 </a> <br /> <span><a

<table> <tr><td> <a href="https://www.reddit.com/r/singularity/comments/1vrtrrh/microsoft_copilot_reveals_secret_input_that/"> <img alt="Microsoft Copilot reveals secret input

<a href="https://news.ycombinator.com/item?id=48272354">Comments</a>

Hidden instructions in a Word document can make Microsoft 365 Copilot rewrite figures in a report, then copy the same instructions into the finished file. Håkon Måløy disclosed

A new type of attack can trick Microsoft Copilot for Word into spreading hidden prompt injections from document to document.

A threat actor targeting Microsoft 365 and Azure production environments is stealing data in attacks that abuse legitimate applications and administration features. [...]

Microsoft has disclosed details of two campaigns in which threat actors are abusing third-party email delivery infrastructure to blast financial fraud scam messages and using