Varonis: SearchLeak: How Hackers Exploit Copilot to Steal Data

Name: Varonis: SearchLeak: How Hackers Exploit Copilot to Steal Data
Uploaded: 2026-07-04T16:12:01-04:00
Duration: 1 min 12 s
Description: Learn more about SearchLeak, a new attack method discovered by Varonis Threat Labs that uses Copilot Enterprise AI to exfiltrate data from enterprise users. Hackers, like the notorious ShinyHunters, are using AI to scale their attack patterns.

Varonis

07/04/2026

0 (0%)

Report Like Favorite

TL;DR

Varonis Threat Labs discovered SearchLeak, an attack that hijacks Microsoft Copilot Enterprise via prompt injection to silently search and exfiltrate data from corporate mailboxes.
The attack is triggered by a single malicious link sent through Teams, email, or Slack, requiring no additional user interaction beyond clicking.
Stolen data is smuggled out through Bing image requests, exploiting Bing's trusted status within the Copilot environment as a covert exfiltration channel.

Summary

Varonis Threat Labs has uncovered SearchLeak, a novel AI-enabled attack chain that weaponizes Microsoft Copilot Enterprise to silently exfiltrate sensitive data from corporate mailboxes. The attack begins with a seemingly harmless link delivered through common workplace channels — Teams, email, or Slack. When clicked, the link opens Copilot but embeds hidden prompt injection instructions that direct the AI to search through the victim's mailbox without their knowledge. Exfiltrated data is concealed inside an image tag, which routes an outbound request through Bing — a trusted, low-suspicion domain within the Copilot ecosystem — ultimately delivering the stolen information to the attacker. What makes SearchLeak particularly dangerous is that it doesn't rely on a single zero-day vulnerability. Instead, it chains together well-known weaknesses — prompt injection, race conditions, and server-side request forgery — and uses AI as the connective tissue to execute them with a single click. Microsoft has since patched the vulnerability, but the broader lesson is significant: AI systems can amplify the impact of legacy attack techniques in ways defenders haven't yet anticipated. SearchLeak follows Varonis Threat Labs' earlier discovery of Reprompt, signaling an emerging pattern of AI-native attack research from the firm.

Chapters

0:00 - Introducing SearchLeak
0:09 - How the Attack Works
0:38 - Bing as the Exfiltration Channel
0:59 - Patch & Key Takeaway

Key Quotes

0:00 "The latest AI attack isn't a single flaw, it's a chain reaction designed to steal data."
0:42 "In Copilot, Bing is trusted, and kind of unassuming, making it the perfect middleman for this attack."
1:02 "AI attacks aren't always about brand new tricks. AI might just be connecting older weaknesses in ways we haven't seen before."

FAQ

Has Microsoft fixed the SearchLeak vulnerability?

Yes. According to Varonis, Microsoft has patched the SearchLeak vulnerability. However, the attack illustrates a broader risk: AI can chain legacy weaknesses in new ways, so ongoing vigilance around AI-connected tools remains essential.

How does SearchLeak exfiltrate data without the victim noticing?

The attack hides stolen data inside an image tag embedded in a Copilot response. When that image loads, it sends an outbound request routed through Bing — a trusted domain — which then passes the data to the attacker, all without visible user interaction.

Categories:

Tags:

Show more Show less

TL;DR

Summary

Chapters

Key Quotes

FAQ

Ensuring Compliance Through Audit Evidence: From CJIS to FERPA

Risk in Real Time Demo Series: Virtual Patching: Protection at the Speed of Exploitation

Harnessing Data Governance for AI with Cyera and Snowflake