Critical Microsoft Copilot CoSnitch Vulnerability (CVE-2026-24301) Enabled One-Click Data Theft From Connected Accounts

Key facts

Detection coverage

As of 2026-08-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2065 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Base64-Encoded Exfiltration to Webhook-Relay Endpoint Following Copilot Sensitive-Data Collection (CoSnitch)

Detects the CoSnitch C2/exfiltration stage: an outbound HTTP GET to a disposable webhook-relay domain (pipedream.net and similar services) carrying a long base64-encoded path segment, correlated with a preceding Copilot connected-account collection event for the same user. Copilot itself performs the outbound fetch via its built-in URL-fetch capability, so the traffic blends in with ordinary Copilot web-fetch activity; the base64 encoding is specifically designed to defeat content filters scanning for plaintext credentials or API-key patterns.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1114, T1530, T1213, T1119, T1132, T1071, T1567, T1020
• Data sources: casb, microsoft_defender_for_cloud_apps, web_proxy, device_network_events, dns
• Severity: critical
• Confidence: high

Splunk SPL

`comment("CoSnitch: base64 exfil GET to webhook-relay endpoint, correlated with prior Copilot connected-account collection")`
index=casb sourcetype="microsoft:defenderforcloudapps:activity" AppName="Microsoft Copilot"
    (ActivityType="Search" OR ActivityType="FileAccessed" OR ActivityType="MailItemsAccessed")
    (ObjectName="*credential*" OR ObjectName="*password*" OR ObjectName="*internal*")
| eval collection_time=_time
| join type=inner user
    [ search index=proxy sourcetype=weblogs
        (url="*pipedream.net*" OR url="*webhook.site*" OR url="*requestbin*" OR url="*ngrok.io*" OR url="*m.pipedream.net*")
      | rex field=url "/exfil/(?<b64_payload>[A-Za-z0-9+/=]{16,})"
      | where isnotnull(b64_payload)
      | eval exfil_time=_time
      | table user, url, b64_payload, exfil_time ]
| where exfil_time > collection_time AND (exfil_time - collection_time) < 300
| table user, collection_time, exfil_time, ObjectName, url, b64_payload

Microsoft KQL

// CoSnitch: collection-to-exfil correlation via base64 webhook GET
let CollectionEvents = CloudAppEvents
| where Timestamp > ago(24h)
| where Application == "Microsoft Copilot"
| where ActionType in ("Search","FileAccessed","MailItemsAccessed")
| where ObjectName has_any ("credential","password","internal")
| project AccountId, CollectionTime=Timestamp, ObjectName;
let ExfilEvents = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any ("pipedream.net","webhook.site","requestbin","ngrok.io")
| where RemoteUrl matches regex @"/exfil/[A-Za-z0-9+/=]{16,}"
| project DeviceName, ExfilTime=Timestamp, RemoteUrl;
CollectionEvents
| join kind=inner (ExfilEvents) on $left.AccountId == $right.DeviceName
| where ExfilTime - CollectionTime between (0min .. 5min)
| project AccountId, CollectionTime, ObjectName, ExfilTime, RemoteUrl

Sigma

title: Base64-Encoded Data Exfiltration to Webhook-Relay Service via AI Assistant (CoSnitch)
id: e91a4c7d-3b8f-4a62-9d1e-6c5b7a2f4d83
status: experimental
description: Detects an outbound HTTP GET to a disposable webhook-relay domain (Pipedream, webhook.site, RequestBin, ngrok) carrying a long base64-encoded path segment, matching the CoSnitch (CVE-2026-24301) exfiltration pattern where Copilot's own URL-fetch capability sends stolen connected-account data to an attacker webhook.
references:
    - https://www.varonis.com/blog/cosnitch
    - https://nvd.nist.gov/vuln/detail/CVE-2026-24301
author: Threadlinqs Team
date: 2026-08-19
tags:
    - attack.exfiltration
    - attack.t1567.002
    - attack.t1020
    - attack.command-and-control
    - attack.t1071.001
    - attack.t1132.001
    - cve.2026.24301
logsource:
    category: proxy
detection:
    selection_domain:
        c-uri|contains:
            - 'pipedream.net'
            - 'webhook.site'
            - 'requestbin'
            - 'ngrok.io'
    selection_path:
        c-uri|re: '/exfil/[A-Za-z0-9+/=]{16,}'
    condition: selection_domain and selection_path
falsepositives:
    - Legitimate developer or QA use of webhook-relay testing services for unrelated integrations
level: critical

Known false positives:

• Developers or QA teams legitimately testing webhook-relay endpoints (Pipedream, webhook.site) unrelated to Copilot
• Legitimate integrations that pass base64-encoded payloads to webhook relays for non-malicious automation

Tuning notes: The exfiltrated data leaves from Microsoft's Copilot backend infrastructure, not necessarily the victim's own device egress -- this query assumes CASB/API-based visibility into Copilot's fetch activity (or SSL-inspected proxy egress if the environment routes AI-assistant traffic through an inline gateway); note that as a known coverage gap in deployments lacking that visibility. Maintain and update the webhook-relay/paste-service domain watchlist (Pipedream, webhook.site, RequestBin, ngrok, Beeceptor, etc.) as these disposable-infrastructure providers rotate. The 5-minute collection-to-exfil correlation window may need widening for slower connections; tighten the base64 path length threshold if benign automation triggers noise.

• 🔒 Copilot autorun=1 Parameter-to-Prompt Injection URL Access (CoSnitch) · unlock with TL Creds
• 🔒 Copilot Connected-Account OAuth Token Abuse for Sensitive-Keyword Collection (CoSnitch) · unlock with TL Creds
• 🔒 Base64-Encoded Exfiltration to Webhook-Relay Endpoint Following Copilot Sensitive-Data Collection (CoSnitch) · unlock with TL Creds
• 🔒 Copilot autorun=1 Parameter-to-Prompt Injection URL Access (CoSnitch) · unlock with TL Creds
• 🔒 Copilot Connected-Account OAuth Token Abuse for Sensitive-Keyword Collection (CoSnitch) · unlock with TL Creds
• 🔒 Base64-Encoded Exfiltration to Webhook-Relay Endpoint Following Copilot Sensitive-Data Collection (CoSnitch) · unlock with TL Creds
• 🔒 Copilot autorun=1 Parameter-to-Prompt Injection URL Access (CoSnitch) · unlock with TL Creds
• 🔒 Copilot Connected-Account OAuth Token Abuse for Sensitive-Keyword Collection (CoSnitch) · unlock with TL Creds

Indicators of compromise

As of 2026-08-19, Threadlinqs Intelligence tracks 12 indicators of compromise for TL-2026-2065.

Sample indicators (1 of 12)

• Domain: eo8el024afgbal3[.]m[.]pipedream[.]net

Defanged, TLP:CLEAR. Full set of 12 indicators: unlock with TL Creds.

Technical analysis

Microsoft patched the issue on August 18, 2026; no active exploitation was found.

CoSnitch is a chained vulnerability disclosed by Varonis Threat Labs researcher Dolev Taler, the third Copilot bug the team reported to Microsoft in 2026 after Reprompt and SearchLeak. The chain combines three distinct weaknesses in Microsoft Copilot Personal (copilot.microsoft.com).

First, an undocumented URL parameter, `autorun=1`, when combined with Copilot's standard `q=` query parameter (which normally just pre-fills the chat input), causes an attacker-supplied prompt embedded in the URL to execute automatically the instant the page loads inside the victim's authenticated session -- with no click, keystroke, or confirmation beyond the initial link click. Varonis found the parameter using a technique they call 'meta-hacking': rather than attacking the product directly, researchers repeatedly asked Copilot to explain why automatic prompt execution 'wasn't possible,' and mined its own explanations and refusals for the exact disabled parameters and internal architecture details needed to build the exploit.

Second, once an attacker prompt is running with the victim's session privileges, it can query any service the victim has already connected to Copilot -- Gmail, Google Drive, Google Calendar, plus Copilot's own chat history and memory store -- without requesting any new permissions. The prompt instructs Copilot to search for sensitive content (e.g., files or messages containing 'credentials,' 'passwords,' 'internal'), base64-encode the retrieved text, and then invoke Copilot's built-in URL-fetch capability to request `https://<attacker-webhook>/exfil/<base64-payload>`. Copilot itself performs the outbound HTTP GET, so the request looks like ordinary Copilot web-fetch traffic and blends in with legitimate activity; the base64 encoding also defeats content filters that scan for plaintext passwords or API-key patterns. In their proof of concept, Varonis used a public webhook-relay endpoint (`m.pipedream.net`) to catch the exfiltrated, base64-encoded data.

Third, and most persistent, a crafted webpage can carry the injection even without a special link: if a victim simply asks Copilot to summarize an attacker-hosted URL, Copilot retrieves the full HTML -- including zero-size, white-on-white hidden text -- and can treat a fake 'SYSTEM: configuration update' instruction embedded in that hidden text as a legitimate directive to write attacker-chosen content into the user's permanent Copilot memory. Memory entries written this way have no expiration, produce no process, file, network, or log artifact that conventional security tooling would flag, and persist through password changes, session revocations, and device re-enrollment -- they are only removed if the user manually deletes them from Copilot's memory settings.

Varonis reported the full chain to Microsoft on December 31, 2025. Microsoft shipped a partial fix on February 1, 2026 that closed only the automatic-execution (`autorun`) vector, leaving the OAuth-connector exfiltration and memory-poisoning-via-summarization vectors open for months. The complete fix for CVE-2026-24301 shipped August 18, 2026, roughly eight months after the initial report. Microsoft stated no customer action is required and that Microsoft 365 Copilot Enterprise customers are unaffected, since CoSnitch is scoped to the consumer Copilot Personal product; analysts noted this framing understates real-world exposure because many enterprise users also run personal Copilot sessions. No evidence of in-the-wild exploitation was found before the patch, and the vulnerability is not present in the CISA KEV catalog.

MITRE ATT&CK / ATLAS techniques by tactic:

execution

AML.T0051 LLM Prompt Injection

Exfiltration

AML.T0056 Extract LLM System Prompt; T1020 Automated Exfiltration; T1567 Exfiltration Over Web Service

Defense Evasion

T1027 Obfuscated Files or Information

Command and Control

T1071 Application Layer Protocol; T1132 Data Encoding

Collection

T1114 Email Collection; T1119 Automated Collection; T1213 Data from Information Repositories; T1530 Data from Cloud Storage

Execution

T1204 User Execution

lateral-movement

T1550 Use Alternate Authentication Material

Initial Access

T1566 Phishing

Resource Development

T1583 Acquire Infrastructure

Remediation

Patches

• Microsoft partially patched the automatic prompt-execution (autorun) vector on 2026-02-01
• Microsoft shipped the complete fix for the full CoSnitch chain (CVE-2026-24301) on 2026-08-18

Immediate actions

• Confirm the Microsoft-side patch for CVE-2026-24301 (shipped 2026-08-18) is applied -- it is server-side for Copilot Personal and requires no customer action per Microsoft
• Review Copilot's saved memory/instructions for unfamiliar or attacker-planted entries and manually delete anything not explicitly authored by the user, since poisoned memory survives password resets and session revocation
• Audit and, where unnecessary, revoke Copilot's connected-account/OAuth grants to Gmail, Google Drive, and Google Calendar

Workarounds

• Until Copilot memory has been reviewed for injected instructions, disable or restrict Copilot Personal's connected-account integrations (Gmail/Drive/Calendar)
• Avoid clicking copilot.microsoft.com links received from untrusted senders, and avoid asking Copilot to summarize untrusted URLs

Longer-term hardening

• Govern AI-assistant connected-account/OAuth grants with the same rigor as any third-party app integration, since they are a direct data-exfiltration surface once the assistant is hijacked
• Monitor for anomalous outbound HTTP requests originating from AI-assistant sessions, including to webhook-relay/paste-style services, since this exfiltration technique is designed to look like normal assistant traffic
• Treat AI-assistant chat deep links (e.g., copilot.microsoft.com URLs carrying query parameters) as a phishing delivery vector and train users not to click unsolicited ones
• Apply prompt-injection sanitization and Task Adherence-style validation to memory-write operations in consumer AI assistants, mirroring protections Microsoft described for Microsoft 365 Copilot Enterprise

Affected and fixed versions

• Microsoft — Microsoft Copilot Personal (Copilot Web, copilot.microsoft.com)
  Vulnerable versions: All Copilot Personal sessions prior to the 2026-08-18 fix
  Fixed in: Patched server-side as of 2026-08-18; Microsoft 365 Copilot Enterprise was not affected by CoSnitch

Timeline

• 2025-12-31 Varonis Threat Labs reports the full CoSnitch vulnerability chain (autorun parameter, OAuth-connector exfiltration, memory poisoning via web summarization) to Microsoft.
• 2026-02-01 Microsoft ships a partial fix that closes only the automatic prompt-execution (autorun) vector, leaving the exfiltration and memory-poisoning vectors open.
• 2026-06-15 Varonis publicly discloses SearchLeak (CVE-2026-42824), a related one-click Parameter-to-Prompt injection chain against Microsoft 365 Copilot Enterprise Search.
• 2026-06-16 Varonis publicly discloses Reprompt, a related single-click Copilot Personal attack using double-request/chain-request techniques to bypass Copilot guardrails.
• 2026-06-22 Microsoft publishes a security blog post acknowledging the AI prompt-injection attack class, describing sanitization and Task Adherence protections in Microsoft 365 Copilot that had not yet extended to Copilot Personal.
• 2026-08-18 NVD publishes CVE-2026-24301 with a CVSS 3.1 base score of 8.8 (CWE-77, improper neutralization of special elements).
• 2026-08-18 Microsoft states no customer action is required and that Microsoft 365 Copilot Enterprise customers are unaffected, since CoSnitch is scoped to Copilot Personal; analysts note this understates exposure for enterprise users who also run personal Copilot.
• 2026-08-18 Microsoft ships the complete fix for CVE-2026-24301 (CoSnitch), roughly eight months after Varonis's initial report.
• 2026-08-19 Varonis Threat Labs and multiple outlets (The Hacker News, Dark Reading, The Register, Cybersecurity News, Computerworld) publish full technical details of the CoSnitch attack chain.

Sources cited

• NVD - CVE-2026-24301 NVD (NIST) · Advisory · 2026-08-18
• CoSnitch (Varonis Threat Labs research writeup) varonis.com · Research · 2026-08-18
• MSRC Security Update Guide - CVE-2026-24301 Microsoft Security Response Center · Vendor report · 2026-08-18
• Reprompt: The Single-Click Microsoft Copilot Attack that Silently Steals Your Personal Data varonis.com · Research · 2026-06-16
• SearchLeak: How We Turned M365 Copilot Into a One-Click Data Exfiltration Weapon varonis.com · Research · 2026-06-15
• Critical Microsoft Copilot CoSnitch Vulnerability Lets Attackers Steal Sensitive Data With One Click cybersecuritynews.com · News · 2026-08-19
• Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps The Hacker News · News · 2026-08-19
• 'CoSnitch' Attack Tricked Copilot into Revealing Own Architecture Dark Reading · News · 2026-08-18
• Copilot tricked into telling researchers how to hack itself The Register · News · 2026-08-18
• Microsoft finally patches critical one-click Copilot vulnerability, almost eight months after learning of it computerworld.com · News · 2026-08-18
• Copilot Exposed Its Own Vulnerabilities When Prompted securitymagazine.com · News · 2026-08-19
• Microsoft Copilot Leaked Its Own Secret Parameter, Enabling One-Click Data Theft finance.biggo.com · News · 2026-08-19

Related threats

• CVE-2026-26133: Cross-Prompt Injection in Microsoft Copilot Email/Teams Summarization Enables AI-Mediated Phishing
• CSS Bomb: JavaScript-Free CSS Keylogging and Token-Theft Attacks Against Gmail, Outlook, Yahoo Mail, AOL Mail, Fastmail, and ProtonMail
• OWASP GenAI LLM Top 10 2026 — Community-Driven Security Guidance for AI Applications
• CSS Bomb Attacks: CSS-Based Trust-Boundary Bypass Leaks Webmail Passwords and Tokens (Outlook, Gmail, Yahoo, AOL, Fastmail, Proton Mail)
• Critical Type Confusion in isolated-vm (GHSA-864f-rcv7-6rh4) Enables Sandbox Escape and RCE on Host

Related coverage of this activity

• Qilin LiteLLM XMRig mining
• Adobe Nvidia August 2026 patches

Previous and next in vulnerability

• khunt Toolkit: SQL Injection Against Oracle/Tomcat Enables In-Database Post-Exploitation Previous report
• CVE-2026-64849 — MLflow Server-Side Request Forgery (SSRF) Vulnerability in Model Registry Webhooks Next report