CVE-2026-26133: Cross-Prompt Injection in Microsoft Copilot Email/Teams Summarization Enables AI-Mediated Phishing

Key facts

Detection coverage

As of 2026-11-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1538 across Splunk SPL, Microsoft KQL and Sigma, covering 35 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Inbound Email with Hidden HTML/CSS Prompt-Injection Obfuscation (CVE-2026-26133)

Detects inbound email HTML bodies containing zero-size-font, off-canvas-positioned, or foreground/background color-matched text blocks — the documented XPIA delivery technique used to smuggle hidden LLM instructions past human recipients into Microsoft 365 Copilot / Teams summarization ingestion.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566.002, T1027, T1036
• Data sources: ms:o365:message-trace, mimecast:content, proofpoint:email, EmailEvents
• Severity: high
• Confidence: high

Splunk SPL

index=email sourcetype="ms:o365:message-trace" OR sourcetype="mimecast:content" OR sourcetype="proofpoint:email"
| eval body=coalesce(message_body, html_body, raw_body)
| regex body="(?i)font-size\s*:\s*0(px|pt)"
| eval offcanvas=if(match(body, "(?i)position\s*:\s*absolute;?\s*left\s*:\s*-\d{3,}px"), 1, 0)
| eval colormatch=if(match(body, "(?i)color\s*:\s*#([0-9a-f]{6})") AND match(body, "(?i)background-color\s*:\s*#([0-9a-f]{6})"), 1, 0)
| where offcanvas=1 OR colormatch=1 OR match(body, "(?i)font-size\s*:\s*0(px|pt)")
| table _time sender recipient subject src_ip offcanvas colormatch
| sort -_time

Microsoft KQL

EmailEvents
| where Timestamp > ago(24h)
| join kind=inner (EmailAttachmentInfo | project NetworkMessageId) on NetworkMessageId
| join kind=inner (EmailUrlInfo) on NetworkMessageId
| extend RawBody = tostring(parse_json(AdditionalFields).body)
| where RawBody has "font-size:0px" or RawBody has "font-size: 0px"
    or (RawBody has "position:absolute" and RawBody matches regex @"left:\s*-\d{3,}px")
    or (RawBody matches regex @"color:\s*#([0-9a-f]{6})" and RawBody has "background-color")
| project Timestamp, SenderFromAddress, RecipientEmailAddress, Subject, NetworkMessageId
| order by Timestamp desc

Sigma

title: Hidden HTML/CSS Obfuscation in Inbound Email (XPIA / CVE-2026-26133)
id: 8f2c1a6e-1a3d-4c9e-9b2f-1e6a7d3c5b01
status: experimental
description: Detects hidden-instruction obfuscation techniques (zero-size font, off-canvas positioning, color-matched text) used in cross-prompt injection attacks against M365 Copilot and Teams email/summarization surfaces.
references:
    - https://permiso.io/blog/copilot-prompt-injection-ai-email-phishing
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26133
author: Threadlinqs Team
date: 2026-07-19
tags:
    - attack.initial-access
    - attack.t1566.002
    - attack.defense-evasion
    - attack.t1027
    - attack.t1036
    - cve.2026.26133
logsource:
    category: mail_flow
    product: m365
detection:
    selection_zero_size:
        content|contains: 'font-size:0px'
    selection_offcanvas:
        content|contains|all:
            - 'position:absolute'
            - 'left:-'
    selection_color_match:
        content|contains|all:
            - 'color:#ffffff'
            - 'background-color:#ffffff'
    condition: 1 of selection_*
falsepositives:
    - Legitimate marketing/tracking-pixel emails that use zero-size elements for analytics
    - Accessibility markup (screen-reader-only text) using off-canvas positioning
level: high

Known false positives:

• Legitimate email marketing/analytics tracking pixels using zero-size or off-canvas markup
• Accessibility (screen-reader-only) text patterns that visually resemble off-canvas hiding

Tuning notes: Scope to external/unauthenticated senders first to cut noise from internal marketing templates; whitelist known ESP (email service provider) domains that legitimately use tracking-pixel CSS patterns before widening to all inbound mail.

• 🔒 Fake Security-Alert Language Rendered by Copilot Summarization (Trust-Transfer Phishing) · unlock with TL Creds
• 🔒 Double-Request Bypass Pattern in Copilot Chat Session (First-Turn Safeguard Evasion) · unlock with TL Creds
• 🔒 Steal Application Access Token via Alternate Authentication Material Post-Copilot-Compromise · unlock with TL Creds
• 🔒 Malicious Link Click Sourced from Copilot Summary UI Rather Than Original Message · unlock with TL Creds
• 🔒 Copilot Session Steal Application Access Token via MFA-Prompt-Generation Lure · unlock with TL Creds
• 🔒 Web Service C2 Beaconing to Attacker-Acquired Infrastructure from Reprompt Chain-Request Flow · unlock with TL Creds
• 🔒 Copilot q-Parameter Prompt-Injection URL Access (Reprompt / P2P Injection) · unlock with TL Creds
• 🔒 Chain-Request Exfiltration to Microsoft Graph Following Untrusted-Sender Ingestion · unlock with TL Creds

Indicators of compromise

As of 2026-11-01, Threadlinqs Intelligence tracks 35 indicators of compromise for TL-2026-1538.

Technical analysis

Disclosed by Permiso Security researcher Andi Ahmeti; Microsoft assigned CVSS 7.1 (CVE-2026-26133) and completed a phased patch rollout by March 11, 2026.

CVE-2026-26133 is an AI command injection / information disclosure vulnerability (CWE-77) in Microsoft 365 Copilot's summarization pipeline. The attack requires no attachment, macro, or traditional exploit code: an attacker only needs to land an ordinary email in the victim's inbox. Using HTML/CSS rendering tricks (e.g., zero-size fonts, off-screen positioning, matching foreground/background colors, or comment-like markup), the attacker embeds instruction-like text within the raw message body. This text is invisible to the human reader in the Outlook reading pane but is fully present in the raw content that Copilot's underlying model ingests when a user clicks "Summarize" in Outlook, opens the Outlook Copilot chat pane, or has the email surfaced through Teams Copilot. Because Copilot does not sufficiently separate trusted system instructions from untrusted email content (insufficient input validation/sanitization per CWE-77), the hidden text is interpreted as executable formatting/behavioral directives rather than as data to summarize. This allows the attacker to steer the assistant's output: rather than producing a faithful synopsis of the email, Copilot renders attacker-authored content -- for example, a fake "unrecognized sign-in" security alert with a call-to-action link -- inside the summary UI that the user implicitly trusts as system-generated. In more advanced variants, the injected instructions direct Copilot to pull additional context from connected Microsoft 365 data sources (Teams messages, OneDrive files, SharePoint documents) via Microsoft Graph, blending real internal data into the attacker-controlled narrative to increase credibility, and creating a secondary information-disclosure risk (CVSS Confidentiality:High) alongside the phishing-enablement risk (Integrity:Low). The vulnerability class is not unique to Microsoft: 0DIN researchers documented an analogous XPIA against Google Gemini for Workspace using the same hidden-instruction-in-email technique to produce system-styled phishing warnings. A related but separate Copilot Personal flaw ("Reprompt", reported by Varonis) demonstrates a complementary attack surface in the same product family: a single malicious link abuses the Copilot web UI's `q` URL parameter to inject a prompt directly (Parameter-to-Prompt / P2P injection), then uses a "double-request" trick to bypass safeguards that only check the first turn of a conversation, and a server-driven "chain-request" technique to issue follow-up instructions based on Copilot's prior responses -- enabling continuous, attacker-directed exfiltration of emails, files, and MFA codes from a single click, without any attachment or credential compromise. Microsoft confirmed CVE-2026-26133 on January 28, 2026 and shipped a phased mitigation (rendering/link-handling behavior changes across the affected Outlook and Teams summarization surfaces) completing rollout on March 11, 2026, one day before the CVE and technical writeup were published.

MITRE ATT&CK / ATLAS techniques by tactic:

Impact

AML.T0048.003 External Harms

Execution

AML.T0051 LLM Prompt Injection; AML.T0051.001 LLM Prompt Injection; AML.T0053 AI Agent Tool Invocation; T1204 User Execution; T1204.001 User Execution

Initial Access

AML.T0052 Phishing; T1566 Phishing; T1566.002 Phishing: Spearphishing Link

Exfiltration

AML.T0057 LLM Data Leakage; T1041 Exfiltration Over C2 Channel; T1048 Exfiltration Over Alternative Protocol

Resource Development

AML.T0066 Retrieval Content Crafting; T1583 Acquire Infrastructure

Defense Evasion

AML.T0067 LLM Trusted Output Components Manipulation; T1027 Obfuscated Files or Information; T1036 Masquerading

Collection

T1005 Data from Local System; T1114 Email Collection; T1213 Data from Information Repositories; T1213.002 Data from Information Repositories: Sharepoint; T1530 Data from Cloud Storage

Command and Control

T1102 Web Service

credential-access

T1187 Forced Authentication

Credential Access

T1528 Steal Application Access Token; T1621 Multi-Factor Authentication Request Generation

Lateral Movement

T1550 Use Alternate Authentication Material

Discovery

T1580 Cloud Infrastructure Discovery

reconnaissance

T1598 Phishing for Information

stealth

T1684.001 Impersonation

Remediation

Patches

• Microsoft 365 Copilot service-side rendering and link-handling fix, phased rollout February 17, 2026 - March 11, 2026, published as CVE-2026-26133 on March 12, 2026

Immediate actions

• Confirm tenant is on the post-March-11-2026 Microsoft 365 Copilot service build (cloud-side fix, no client action required for most surfaces)
• Educate users that Copilot-generated summaries and security-style alerts are not authoritative system notifications and should not be trusted for security decisions
• Enable Safe Links / URL rewriting in Exchange Online Protection and Defender for Office 365 so links surfaced inside Copilot summaries are still scanned
• Review Outlook and Teams Copilot usage logs (Microsoft Purview / Unified Audit Log) for anomalous summarization requests correlating with suspicious inbound mail

Workarounds

• Disable or restrict Copilot Summarize/Chat surfaces in Outlook and Teams for high-risk user groups until confirmed patched
• Configure mail flow rules to strip or flag hidden/obfuscated HTML content (invisible text, off-screen divs, transparent fonts) in inbound external mail

Longer-term hardening

• Deploy prompt-injection-aware email content filtering that flags HTML/CSS obfuscation techniques (hidden text, zero-size fonts, off-canvas positioning, color-matched text)
• Adopt AI red-teaming / XPIA-specific testing for any LLM feature that ingests untrusted external content (email, chat, documents) before granting it UI real estate that implies system trust
• Architect LLM-integrated productivity features so system instructions and untrusted content are cryptographically or structurally separated (instruction/data channel isolation) rather than concatenated into a single prompt
• Monitor for the related 'Reprompt' class of attack (URL-parameter prompt injection via the Copilot `q` parameter) and apply the same phishing-awareness training to Copilot Personal users

Affected and fixed versions

• Microsoft — Microsoft 365 Copilot (Outlook Summarize / Copilot pane, Teams Copilot summarization)
  Vulnerable versions: Microsoft 365 Copilot cloud service, all tenants prior to patch rollout completion
  Fixed in: Microsoft 365 Copilot cloud service post March 11, 2026 rollout
• Microsoft — Outlook (Web, Desktop, iOS, Android) Copilot integration
  Vulnerable versions: All Copilot-enabled Outlook clients prior to patch
  Fixed in: Patched service-side, no client version pin published
• Microsoft — Microsoft Teams Copilot summarization
  Vulnerable versions: All Copilot-enabled Teams tenants prior to patch
  Fixed in: Patched service-side, no client version pin published

Timeline

Last updated 2026-11-01 · 2 updates · revalidated 2× · latest source

• 2025-07-10 0DIN publishes 'Phishing For Gemini,' documenting the structurally identical hidden HTML/CSS indirect-prompt-injection phishing technique against Google Gemini for Workspace's email summarization -- prior art Permiso cites in its Copilot write-up.
• 2026-01-23 Permiso Security researcher Andi Ahmeti reports the Copilot cross-prompt injection technique to Microsoft.
• 2026-01-26 Microsoft acknowledges the report and begins internal triage.
• 2026-01-27 Permiso provides detailed reproduction cases to Microsoft.
• 2026-01-28 Microsoft confirms internal reproduction of the vulnerability across Outlook and Teams Copilot summarization surfaces.
• 2026-01-30 Microsoft completes reproduction and begins planning mitigation across the affected Copilot surfaces.
• 2026-02-17 Microsoft begins phased mitigation rollout across affected Copilot summarization surfaces.
• 2026-03-11 Microsoft completes the phased patch rollout across all affected Outlook and Teams Copilot surfaces.
• 2026-03-12 CVE-2026-26133 is published (CVSS 7.1) and Permiso Security releases the full technical writeup 'CO-PILOT, DISENGAGE AUTOPHISH'.
• 2026-03-16 CVE-2026-26133 is published in the NVD and via Microsoft's Security Update Guide, assigning CVSS 3.1 base score 7.1 (HIGH) and CWE-77.
• 2026-06-01 Varonis publishes 'Reprompt', a related single-click Microsoft Copilot Personal prompt-injection attack (URL `q`-parameter injection, double-request bypass, chain-request exfiltration) capable of stealing emails, files, and MFA codes, covered by The Hacker News.
• 2026-06-15 Varonis Threat Labs discloses 'SearchLeak', a parallel vulnerability chain affecting Microsoft 365 Copilot Enterprise search/summarization surfaces; distinct from Reprompt (which targets Copilot Personal) and referenced alongside the separate 'EchoLeak' AI vulnerability class requiring user prompts or plugin interaction.
• 2026-09-09 Lookout publishes an advisory on CVE-2026-26133 and reports no in-the-wild exploitation at the time of writing.

Update history

• 2026-11-01 — Cross-Prompt Injection in Microsoft Copilot AI Email Summaries Enables Phishing (CVE-2026-26133): What changed Exploitability THEORETICAL → POC_PUBLIC. Permiso's public writeup demonstrates working alert-style injection payloads that succeeded on some surfaces, most reliably in Teams.
• 2026-09-09 — Cross-Prompt Injection in Microsoft Copilot Email/Teams Summarization Enables Phishing (CVE-2026-26133): What changed No severity, exploitability, or CVSS escalation (still HIGH / THEORETICAL / 7.1 in both reports).

Sources cited

• CVE-2026-26133: M365 Copilot Information Disclosure Flaw SentinelOne · Research · 2026-03-12
• CVE-2026-26133 vulnerability details Microsoft Security Response Center · Vendor report · 2026-03-12
• Reprompt: The Single-Click Microsoft Copilot Attack that Silently Steals Your Personal Data varonis.com · Research · 2026-06-01
• CO-PILOT, DISENGAGE AUTOPHISH: The New Phishing Surface Hiding Inside AI Email Summaries permiso.io · Blog · 2026-03-12
• Copilot Can Be Weaponized: What CVE-2026-26133 Means for Microsoft 365 Admins thomasjuhlolesen.dk · Blog · 2026-03-12
• Microsoft 365 Copilot Security: Enterprise CISO Guide 2026 beyondscale.tech · Blog · 2026-03-15
• CVE-2026-26133: Microsoft 365 Copilot Information Disclosure and the Confidence Signal windowsforum.com · News · 2026-03-12
• Microsoft: Microsoft Copilot Email and Teams Summarization Vulnerability Enables Phishing Attacks blog.rankiteo.com · News · 2026-03-12
• One-Click Microsoft 365 Copilot Flaw Could Have Let Attackers Steal Emails, Files, and MFA Codes The Hacker News · News · 2026-06-01
• M365 Copilot AI Prompt Injection Attack Patched; Salesforce Misconfigurations Risk Data Leaks; Patch Tuesday: Microsoft and Adobe sans.org · News · 2026-03-13

Related threats

• Zero-Click Cryptographic Context Injection Attack Exfiltrates Grok Chat Data via Malicious Webpages
• 91 Spring Framework CVEs Disclosed by Broadcom, Including Critical Deserialization Flaw CVE-2026-59285
• Claude in Chrome Prompt Injection Steals Gmail Codes to Hijack Slack, X, and Claude.ai Accounts

Related coverage of this activity

• CoSnitch Copilot data theft

Previous and next in vulnerability

• Microsoft Office RCE via Preview Pane (CVE-2026-26110, CVE-2026-26113) — March 2026 Patch Tuesday Previous report
• CVE-2026-21262: Microsoft SQL Server Elevation of Privilege via Improper Access Control in Merge Replication Next report

Further reading

• CrowdStrike Prompt Injection Taxonomy for LLMs