threat research

On June 15, 2026, Varonis Threat Labs disclosed SearchLeak, a now-patched vulnerability chain in Microsoft 365 Copilot Enterprise Search that could have let an attacker exfiltrate emails, files, meeting data, and security codes after a victim clicked a crafted Microsoft link. The uncomfortable...

On June 15, 2026, Varonis Threat Labs disclosed SearchLeak, a patched Microsoft 365 Copilot Enterprise vulnerability chain that could let an attacker use a single malicious link to make Copilot search a victim’s Microsoft 365 data and exfiltrate sensitive results through Bing. Microsoft says it...

Microsoft fixed CVE-2026-42824, a Microsoft 365 Copilot information-disclosure vulnerability disclosed in June 2026, after Varonis researchers described a one-click “SearchLeak” attack chain that abused Copilot Search, browser rendering behavior, and Microsoft service trust to leak enterprise...

A new, deceptively simple attack named “Reprompt” has exposed a critical weakness in Microsoft Copilot Personal: with a single click on a legitimate Copilot deep link an attacker could, under the right conditions, mount a multistage, stealthy data‑exfiltration chain that pulls names, locations...