Researchers have uncovered a significant security vulnerability in Microsoft 365 Copilot that allowed attackers to extract sensitive user information through a complex exploit chain. Although this vulnerability has since been addressed, it previously involved a series of techniques that bypassed security measures and enabled data theft.
The exploit chain, identified by security expert Johann Rehberger, utilized a combination of prompt injection, automatic tool activation, and an innovative method called ASCII smuggling. It began with a malicious email or document containing a precisely designed prompt injection payload. This payload instructed Copilot to search for additional emails and documents autonomously, bringing confidential content into the chat interface. Additionally, the exploit could automatically trigger tools within Copilot, enabling it to access data such as Slack MFA codes or sales figures from other integrated sources.
The most novel aspect of the attack was the use of ASCII smuggling to conceal the stolen data. This technique involves embedding special Unicode characters that resemble ASCII but remain invisible in the user interface. The attacker could hide this covert data within seemingly harmless clickable hyperlinks. When a user clicked on one of these links, the hidden sensitive information would be transmitted to a server under the attacker’s control. Rehberger demonstrated how this method could be used to steal and decode data like sales figures and MFA codes.
The complete exploit chain included:
- Prompt injection through malicious content
- Automatic tool activation to retrieve additional data
- ASCII smuggling to conceal exfiltrated information
- Rendering of hyperlinks leading to attacker-controlled servers
Following responsible disclosure in January 2024, Microsoft has addressed these vulnerabilities. While specific details about the fix remain unclear, the original proof-of-concept exploits no longer function, and it appears that link rendering has been altered.
“It’s uncertain exactly how Microsoft resolved the issue or what mitigation strategies were put in place. However, the exploits I developed and shared with them in January and February are no longer effective,” Johann Rehberger stated.
