# CVE-2026-26133: Cross-Prompt Injection in Microsoft Copilot Email/Teams Summarization Enables AI-Mediated Phishing

> A cross-prompt injection (XPIA) flaw in Microsoft 365 Copilot's email and Teams summarization surfaces let attackers embed HTML/CSS-hidden instructions in ordinary emails that the underlying LLM ingests but the human recipient never sees, hijacking Copilot's trusted summary UI to present fake security alerts and phishing links as system-generated content. Disclosed by Permiso Security researcher Andi Ahmeti; Microsoft assigned CVSS 7.1 (CVE-2026-26133) and completed a phased patch rollout by March 11, 2026.

- **Published:** 2026-03-12T00:00:00Z
- **Last reviewed:** 2026-11-01T00:46:19.764Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1538
- **ID:** TL-2026-1538
- **Severity:** HIGH (CVSS 7.1)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 35
- **CVEs:** CVE-2026-26133

## Description

CVE-2026-26133 is an AI command injection / information disclosure vulnerability (CWE-77) in Microsoft 365 Copilot's summarization pipeline. The attack requires no attachment, macro, or traditional exploit code: an attacker only needs to land an ordinary email in the victim's inbox. Using HTML/CSS rendering tricks (e.g., zero-size fonts, off-screen positioning, matching foreground/background colors, or comment-like markup), the attacker embeds instruction-like text within the raw message body. This text is invisible to the human reader in the Outlook reading pane but is fully present in the raw content that Copilot's underlying model ingests when a user clicks "Summarize" in Outlook, opens the Outlook Copilot chat pane, or has the email surfaced through Teams Copilot. Because Copilot does not sufficiently separate trusted system instructions from untrusted email content (insufficient input validation/sanitization per CWE-77), the hidden text is interpreted as executable formatting/behavioral directives rather than as data to summarize. This allows the attacker to steer the assistant's output: rather than producing a faithful synopsis of the email, Copilot renders attacker-authored content -- for example, a fake "unrecognized sign-in" security alert with a call-to-action link -- inside the summary UI that the user implicitly trusts as system-generated. In more advanced variants, the injected instructions direct Copilot to pull additional context from connected Microsoft 365 data sources (Teams messages, OneDrive files, SharePoint documents) via Microsoft Graph, blending real internal data into the attacker-controlled narrative to increase credibility, and creating a secondary information-disclosure risk (CVSS Confidentiality:High) alongside the phishing-enablement risk (Integrity:Low). The vulnerability class is not unique to Microsoft: 0DIN researchers documented an analogous XPIA against Google Gemini for Workspace using the same hidden-instruction-in-email technique to produce system-styled phishing warnings. A related but separate Copilot Personal flaw ("Reprompt", reported by Varonis) demonstrates a complementary attack surface in the same product family: a single malicious link abuses the Copilot web UI's `q` URL parameter to inject a prompt directly (Parameter-to-Prompt / P2P injection), then uses a "double-request" trick to bypass safeguards that only check the first turn of a conversation, and a server-driven "chain-request" technique to issue follow-up instructions based on Copilot's prior responses -- enabling continuous, attacker-directed exfiltration of emails, files, and MFA codes from a single click, without any attachment or credential compromise. Microsoft confirmed CVE-2026-26133 on January 28, 2026 and shipped a phased mitigation (rendering/link-handling behavior changes across the affected Outlook and Teams summarization surfaces) completing rollout on March 11, 2026, one day before the CVE and technical writeup were published.

## MITRE ATT&CK

- T1566 Phishing
- T1204 User Execution
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1684.001 Impersonation
- T1598 Phishing for Information
- T1621 Multi-Factor Authentication Request Generation
- T1213 Data from Information Repositories
- T1114 Email Collection
- T1005 Data from Local System
- T1041 Exfiltration Over C2 Channel
- T1187 Forced Authentication
- T1580 Cloud Infrastructure Discovery
- T1530 Data from Cloud Storage
- T1528 Steal Application Access Token
- T1550 Use Alternate Authentication Material
- T1102 Web Service
- T1583 Acquire Infrastructure
- T1204.001 User Execution
- AML.T0051.001 LLM Prompt Injection
- AML.T0052 Phishing
- AML.T0057 LLM Data Leakage
- AML.T0053 AI Agent Tool Invocation
- AML.T0066 Retrieval Content Crafting
- AML.T0067 LLM Trusted Output Components Manipulation
- AML.T0048.003 External Harms
- T1566.002 Phishing: Spearphishing Link
- T1213.002 Data from Information Repositories: Sharepoint
- T1048 Exfiltration Over Alternative Protocol
- AML.T0051 LLM Prompt Injection

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Inbound Email with Hidden HTML/CSS Prompt-Injection Obfuscation (CVE-2026-26133)** (`TL-2026-1538-SPL-001`)

Detects inbound email HTML bodies containing zero-size-font, off-canvas-positioned, or foreground/background color-matched text blocks — the documented XPIA delivery technique used to smuggle hidden LLM instructions past human recipients into Microsoft 365 Copilot / Teams summarization ingestion.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.002, T1027, T1036
- **Data sources:** ms:o365:message-trace, mimecast:content, proofpoint:email, EmailEvents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=email sourcetype="ms:o365:message-trace" OR sourcetype="mimecast:content" OR sourcetype="proofpoint:email"
| eval body=coalesce(message_body, html_body, raw_body)
| regex body="(?i)font-size\s*:\s*0(px|pt)"
| eval offcanvas=if(match(body, "(?i)position\s*:\s*absolute;?\s*left\s*:\s*-\d{3,}px"), 1, 0)
| eval colormatch=if(match(body, "(?i)color\s*:\s*#([0-9a-f]{6})") AND match(body, "(?i)background-color\s*:\s*#([0-9a-f]{6})"), 1, 0)
| where offcanvas=1 OR colormatch=1 OR match(body, "(?i)font-size\s*:\s*0(px|pt)")
| table _time sender recipient subject src_ip offcanvas colormatch
| sort -_time
```

### Microsoft KQL

```kql
EmailEvents
| where Timestamp > ago(24h)
| join kind=inner (EmailAttachmentInfo | project NetworkMessageId) on NetworkMessageId
| join kind=inner (EmailUrlInfo) on NetworkMessageId
| extend RawBody = tostring(parse_json(AdditionalFields).body)
| where RawBody has "font-size:0px" or RawBody has "font-size: 0px"
    or (RawBody has "position:absolute" and RawBody matches regex @"left:\s*-\d{3,}px")
    or (RawBody matches regex @"color:\s*#([0-9a-f]{6})" and RawBody has "background-color")
| project Timestamp, SenderFromAddress, RecipientEmailAddress, Subject, NetworkMessageId
| order by Timestamp desc
```

### Sigma

```yaml
title: Hidden HTML/CSS Obfuscation in Inbound Email (XPIA / CVE-2026-26133)
id: 8f2c1a6e-1a3d-4c9e-9b2f-1e6a7d3c5b01
status: experimental
description: Detects hidden-instruction obfuscation techniques (zero-size font, off-canvas positioning, color-matched text) used in cross-prompt injection attacks against M365 Copilot and Teams email/summarization surfaces.
references:
    - https://permiso.io/blog/copilot-prompt-injection-ai-email-phishing
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26133
author: Threadlinqs Team
date: 2026-07-19
tags:
    - attack.initial-access
    - attack.t1566.002
    - attack.defense-evasion
    - attack.t1027
    - attack.t1036
    - cve.2026.26133
logsource:
    category: mail_flow
    product: m365
detection:
    selection_zero_size:
        content|contains: 'font-size:0px'
    selection_offcanvas:
        content|contains|all:
            - 'position:absolute'
            - 'left:-'
    selection_color_match:
        content|contains|all:
            - 'color:#ffffff'
            - 'background-color:#ffffff'
    condition: 1 of selection_*
falsepositives:
    - Legitimate marketing/tracking-pixel emails that use zero-size elements for analytics
    - Accessibility markup (screen-reader-only text) using off-canvas positioning
level: high
```

**Known false positives:**

- Legitimate email marketing/analytics tracking pixels using zero-size or off-canvas markup
- Accessibility (screen-reader-only) text patterns that visually resemble off-canvas hiding

**Tuning notes:** Scope to external/unauthenticated senders first to cut noise from internal marketing templates; whitelist known ESP (email service provider) domains that legitimately use tracking-pixel CSS patterns before widening to all inbound mail.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Fake Security-Alert Language Rendered by Copilot Summarization (Trust-Transfer Phishing) (locked: unlock with TL Creds)
- Double-Request Bypass Pattern in Copilot Chat Session (First-Turn Safeguard Evasion) (locked: unlock with TL Creds)
- Steal Application Access Token via Alternate Authentication Material Post-Copilot-Compromise (locked: unlock with TL Creds)
- Malicious Link Click Sourced from Copilot Summary UI Rather Than Original Message (locked: unlock with TL Creds)
- Copilot Session Steal Application Access Token via MFA-Prompt-Generation Lure (locked: unlock with TL Creds)
- Web Service C2 Beaconing to Attacker-Acquired Infrastructure from Reprompt Chain-Request Flow (locked: unlock with TL Creds)
- Copilot q-Parameter Prompt-Injection URL Access (Reprompt / P2P Injection) (locked: unlock with TL Creds)
- Chain-Request Exfiltration to Microsoft Graph Following Untrusted-Sender Ingestion (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [CO-PILOT, DISENGAGE AUTOPHISH: The New Phishing Surface Hiding Inside AI Email Summaries](https://permiso.io/blog/copilot-prompt-injection-ai-email-phishing)
- [CVE-2026-26133: M365 Copilot Information Disclosure Flaw](https://www.sentinelone.com/vulnerability-database/cve-2026-26133/)
- [CVE-2026-26133 vulnerability details](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26133)
- [CVE-2026-26133: Microsoft 365 Copilot Information Disclosure and the Confidence Signal](https://windowsforum.com/threads/cve-2026-26133-microsoft-365-copilot-information-disclosure-and-the-confidence-signal.404852/)
- [Copilot Can Be Weaponized: What CVE-2026-26133 Means for Microsoft 365 Admins](https://www.thomasjuhlolesen.dk/2026/03/copilot-can-be-weaponized-what-cve-2026-26133-means-for-microsoft-365-admins.html)
- [Microsoft: Microsoft Copilot Email and Teams Summarization Vulnerability Enables Phishing Attacks](https://blog.rankiteo.com/mic1773325442-microsoft-vulnerability-march-2026/)
- [One-Click Microsoft 365 Copilot Flaw Could Have Let Attackers Steal Emails, Files, and MFA Codes](https://thehackernews.com/2026/06/one-click-microsoft-365-copilot-flaw.html)
- [Reprompt: The Single-Click Microsoft Copilot Attack that Silently Steals Your Personal Data](https://www.varonis.com/blog/reprompt)
- [M365 Copilot AI Prompt Injection Attack Patched; Salesforce Misconfigurations Risk Data Leaks; Patch Tuesday: Microsoft and Adobe](https://www.sans.org/newsletters/newsbites/xxvii-45)
- [Microsoft 365 Copilot Security: Enterprise CISO Guide 2026](https://beyondscale.tech/blog/microsoft-365-copilot-security-enterprise-guide)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1538