M365 Copilot Business Chat SearchLeak Open-Redirect Prompt-Injection Exfil (CVE-2026-47645)
A malicious link to Microsoft's own Copilot search page can smuggle hidden instructions to the AI assistant. Once clicked, Copilot follows those instructions using the victim's own permissions and quietly sends mailbox or file contents to an attacker-controlled server.
How the attack works
An attacker crafts a link to the trusted m365.cloud.microsoft/search/ page but hides malicious instructions inside the search query parameter instead of a normal search term. The victim clicks the link, believing it's a legitimate Microsoft page, and Copilot Business Chat processes the hidden instructions as if the user had typed them. Copilot then acts with the victim's own mailbox and file access. It exfiltrates the retrieved data by embedding it in a Bing image-search URL pointed at a server the attacker controls, using the image request itself as the delivery channel.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 121fc941-a1d1-413e-a973-79a961e4cdf9
- Severity
- Critical
- CVEs
- CVE-2026-47645
Why it matters
An attacker can silently read and steal a victim's email or file contents with a single clicked link, using the victim's own Copilot session and permissions, without needing separate credentials or malware.
What you can do
- →Treat m365.cloud.microsoft/search links with unusually long or encoded query strings as suspicious, especially in email or chat.
- →Monitor outbound traffic for Bing image-search requests (searchbyimage/cbir) pointing to unfamiliar or non-Microsoft image hosts.
- →Restrict or review what data sources and mailbox scopes Copilot Business Chat can access by default for each user.
- →Educate users that clicking a trusted-looking Microsoft link can still trigger unwanted AI actions, and report unexpected Copilot behavior after clicking a link.
Known benign look-alikes
- A user legitimately sharing a normal M365 Copilot search link (m365.cloud.microsoft/search/?q=quarterly+report) that contains only a benign natural-language query with no injected instructions or image/exfil markup.
- Documentation or a bug report quoting the m365.cloud.microsoft/search endpoint or Bing reverse-image-search URL without an attacker imgurl host carrying captured data.