# Critical Microsoft Copilot CoSnitch Vulnerability (CVE-2026-24301) Enabled One-Click Data Theft From Connected Accounts

> Varonis Threat Labs disclosed CoSnitch (CVE-2026-24301), a three-part Microsoft Copilot Personal flaw chain that let a single malicious link silently auto-execute an attacker prompt, exfiltrate data from connected Gmail/Google Drive/Calendar accounts via base64-encoded HTTP requests, and plant instructions in Copilot's permanent memory that survive password changes, session revocation, and device re-enrollment. Microsoft patched the issue on August 18, 2026; no active exploitation was found.

- **Published:** 2026-08-19T00:00:00Z
- **Last reviewed:** 2026-08-19T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2065
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-cosnitch-copilot-data-theft-tl-2026-2065.webp?v=e7f29a6d (Threadlinqs threat intel: CVE-2026-24301 CoSnitch Copilot Flaw: Detection & IOCs (TL-2026-2065) — Critical severity, 12 IOCs, 9 detection rules.)
- **ID:** TL-2026-2065
- **Severity:** CRITICAL (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 12 (1 shown free below)
- **CVEs:** CVE-2026-24301

## Description

CoSnitch is a chained vulnerability disclosed by Varonis Threat Labs researcher Dolev Taler, the third Copilot bug the team reported to Microsoft in 2026 after Reprompt and SearchLeak. The chain combines three distinct weaknesses in Microsoft Copilot Personal (copilot.microsoft.com).

First, an undocumented URL parameter, `autorun=1`, when combined with Copilot's standard `q=` query parameter (which normally just pre-fills the chat input), causes an attacker-supplied prompt embedded in the URL to execute automatically the instant the page loads inside the victim's authenticated session -- with no click, keystroke, or confirmation beyond the initial link click. Varonis found the parameter using a technique they call 'meta-hacking': rather than attacking the product directly, researchers repeatedly asked Copilot to explain why automatic prompt execution 'wasn't possible,' and mined its own explanations and refusals for the exact disabled parameters and internal architecture details needed to build the exploit.

Second, once an attacker prompt is running with the victim's session privileges, it can query any service the victim has already connected to Copilot -- Gmail, Google Drive, Google Calendar, plus Copilot's own chat history and memory store -- without requesting any new permissions. The prompt instructs Copilot to search for sensitive content (e.g., files or messages containing 'credentials,' 'passwords,' 'internal'), base64-encode the retrieved text, and then invoke Copilot's built-in URL-fetch capability to request `https://<attacker-webhook>/exfil/<base64-payload>`. Copilot itself performs the outbound HTTP GET, so the request looks like ordinary Copilot web-fetch traffic and blends in with legitimate activity; the base64 encoding also defeats content filters that scan for plaintext passwords or API-key patterns. In their proof of concept, Varonis used a public webhook-relay endpoint (`m.pipedream.net`) to catch the exfiltrated, base64-encoded data.

Third, and most persistent, a crafted webpage can carry the injection even without a special link: if a victim simply asks Copilot to summarize an attacker-hosted URL, Copilot retrieves the full HTML -- including zero-size, white-on-white hidden text -- and can treat a fake 'SYSTEM: configuration update' instruction embedded in that hidden text as a legitimate directive to write attacker-chosen content into the user's permanent Copilot memory. Memory entries written this way have no expiration, produce no process, file, network, or log artifact that conventional security tooling would flag, and persist through password changes, session revocations, and device re-enrollment -- they are only removed if the user manually deletes them from Copilot's memory settings.

Varonis reported the full chain to Microsoft on December 31, 2025. Microsoft shipped a partial fix on February 1, 2026 that closed only the automatic-execution (`autorun`) vector, leaving the OAuth-connector exfiltration and memory-poisoning-via-summarization vectors open for months. The complete fix for CVE-2026-24301 shipped August 18, 2026, roughly eight months after the initial report. Microsoft stated no customer action is required and that Microsoft 365 Copilot Enterprise customers are unaffected, since CoSnitch is scoped to the consumer Copilot Personal product; analysts noted this framing understates real-world exposure because many enterprise users also run personal Copilot sessions. No evidence of in-the-wild exploitation was found before the patch, and the vulnerability is not present in the CISA KEV catalog.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1566 Phishing
- T1204 User Execution
- T1550 Use Alternate Authentication Material
- T1027 Obfuscated Files or Information
- T1114 Email Collection
- T1530 Data from Cloud Storage
- T1213 Data from Information Repositories
- T1119 Automated Collection
- T1132 Data Encoding
- T1071 Application Layer Protocol
- T1567 Exfiltration Over Web Service
- T1020 Automated Exfiltration
- AML.T0051 LLM Prompt Injection
- AML.T0056 Extract LLM System Prompt

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Base64-Encoded Exfiltration to Webhook-Relay Endpoint Following Copilot Sensitive-Data Collection (CoSnitch)** (`TL-2026-2065-SPL-003`)

Detects the CoSnitch C2/exfiltration stage: an outbound HTTP GET to a disposable webhook-relay domain (pipedream.net and similar services) carrying a long base64-encoded path segment, correlated with a preceding Copilot connected-account collection event for the same user. Copilot itself performs the outbound fetch via its built-in URL-fetch capability, so the traffic blends in with ordinary Copilot web-fetch activity; the base64 encoding is specifically designed to defeat content filters scanning for plaintext credentials or API-key patterns.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1114, T1530, T1213, T1119, T1132, T1071, T1567, T1020
- **Data sources:** casb, microsoft_defender_for_cloud_apps, web_proxy, device_network_events, dns
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
`comment("CoSnitch: base64 exfil GET to webhook-relay endpoint, correlated with prior Copilot connected-account collection")`
index=casb sourcetype="microsoft:defenderforcloudapps:activity" AppName="Microsoft Copilot"
    (ActivityType="Search" OR ActivityType="FileAccessed" OR ActivityType="MailItemsAccessed")
    (ObjectName="*credential*" OR ObjectName="*password*" OR ObjectName="*internal*")
| eval collection_time=_time
| join type=inner user
    [ search index=proxy sourcetype=weblogs
        (url="*pipedream.net*" OR url="*webhook.site*" OR url="*requestbin*" OR url="*ngrok.io*" OR url="*m.pipedream.net*")
      | rex field=url "/exfil/(?<b64_payload>[A-Za-z0-9+/=]{16,})"
      | where isnotnull(b64_payload)
      | eval exfil_time=_time
      | table user, url, b64_payload, exfil_time ]
| where exfil_time > collection_time AND (exfil_time - collection_time) < 300
| table user, collection_time, exfil_time, ObjectName, url, b64_payload
```

### Microsoft KQL

```kql
// CoSnitch: collection-to-exfil correlation via base64 webhook GET
let CollectionEvents = CloudAppEvents
| where Timestamp > ago(24h)
| where Application == "Microsoft Copilot"
| where ActionType in ("Search","FileAccessed","MailItemsAccessed")
| where ObjectName has_any ("credential","password","internal")
| project AccountId, CollectionTime=Timestamp, ObjectName;
let ExfilEvents = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any ("pipedream.net","webhook.site","requestbin","ngrok.io")
| where RemoteUrl matches regex @"/exfil/[A-Za-z0-9+/=]{16,}"
| project DeviceName, ExfilTime=Timestamp, RemoteUrl;
CollectionEvents
| join kind=inner (ExfilEvents) on $left.AccountId == $right.DeviceName
| where ExfilTime - CollectionTime between (0min .. 5min)
| project AccountId, CollectionTime, ObjectName, ExfilTime, RemoteUrl
```

### Sigma

```yaml
title: Base64-Encoded Data Exfiltration to Webhook-Relay Service via AI Assistant (CoSnitch)
id: e91a4c7d-3b8f-4a62-9d1e-6c5b7a2f4d83
status: experimental
description: Detects an outbound HTTP GET to a disposable webhook-relay domain (Pipedream, webhook.site, RequestBin, ngrok) carrying a long base64-encoded path segment, matching the CoSnitch (CVE-2026-24301) exfiltration pattern where Copilot's own URL-fetch capability sends stolen connected-account data to an attacker webhook.
references:
    - https://www.varonis.com/blog/cosnitch
    - https://nvd.nist.gov/vuln/detail/CVE-2026-24301
author: Threadlinqs Team
date: 2026-08-19
tags:
    - attack.exfiltration
    - attack.t1567.002
    - attack.t1020
    - attack.command-and-control
    - attack.t1071.001
    - attack.t1132.001
    - cve.2026.24301
logsource:
    category: proxy
detection:
    selection_domain:
        c-uri|contains:
            - 'pipedream.net'
            - 'webhook.site'
            - 'requestbin'
            - 'ngrok.io'
    selection_path:
        c-uri|re: '/exfil/[A-Za-z0-9+/=]{16,}'
    condition: selection_domain and selection_path
falsepositives:
    - Legitimate developer or QA use of webhook-relay testing services for unrelated integrations
level: critical
```

**Known false positives:**

- Developers or QA teams legitimately testing webhook-relay endpoints (Pipedream, webhook.site) unrelated to Copilot
- Legitimate integrations that pass base64-encoded payloads to webhook relays for non-malicious automation

**Tuning notes:** The exfiltrated data leaves from Microsoft's Copilot backend infrastructure, not necessarily the victim's own device egress -- this query assumes CASB/API-based visibility into Copilot's fetch activity (or SSL-inspected proxy egress if the environment routes AI-assistant traffic through an inline gateway); note that as a known coverage gap in deployments lacking that visibility. Maintain and update the webhook-relay/paste-service domain watchlist (Pipedream, webhook.site, RequestBin, ngrok, Beeceptor, etc.) as these disposable-infrastructure providers rotate. The 5-minute collection-to-exfil correlation window may need widening for slower connections; tighten the base64 path length threshold if benign automation triggers noise.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Copilot autorun=1 Parameter-to-Prompt Injection URL Access (CoSnitch) (locked: unlock with TL Creds)
- Copilot Connected-Account OAuth Token Abuse for Sensitive-Keyword Collection (CoSnitch) (locked: unlock with TL Creds)
- Base64-Encoded Exfiltration to Webhook-Relay Endpoint Following Copilot Sensitive-Data Collection (CoSnitch) (locked: unlock with TL Creds)
- Copilot autorun=1 Parameter-to-Prompt Injection URL Access (CoSnitch) (locked: unlock with TL Creds)
- Copilot Connected-Account OAuth Token Abuse for Sensitive-Keyword Collection (CoSnitch) (locked: unlock with TL Creds)
- Base64-Encoded Exfiltration to Webhook-Relay Endpoint Following Copilot Sensitive-Data Collection (CoSnitch) (locked: unlock with TL Creds)
- Copilot autorun=1 Parameter-to-Prompt Injection URL Access (CoSnitch) (locked: unlock with TL Creds)
- Copilot Connected-Account OAuth Token Abuse for Sensitive-Keyword Collection (CoSnitch) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 12)

Defanged, TLP:CLEAR.

- Domain: `eo8el024afgbal3[.]m[.]pipedream[.]net`

Full set of 12 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Critical Microsoft Copilot CoSnitch Vulnerability Lets Attackers Steal Sensitive Data With One Click](https://cybersecuritynews.com/copilot-cosnitch-vulnerability/)
- [CoSnitch (Varonis Threat Labs research writeup)](https://www.varonis.com/blog/cosnitch)
- [Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps](https://thehackernews.com/2026/08/microsoft-copilot-personal-flaws-could.html)
- ['CoSnitch' Attack Tricked Copilot into Revealing Own Architecture](https://www.darkreading.com/vulnerabilities-threats/cosnitch-attack-copilot-mapping-out-architecture)
- [Copilot tricked into telling researchers how to hack itself](https://www.theregister.com/research/2026/08/18/copilot-tricked-into-telling-reseachers-how-to-hack-itself/5288857)
- [Microsoft finally patches critical one-click Copilot vulnerability, almost eight months after learning of it](https://www.computerworld.com/article/4211325/microsoft-finally-patches-critical-one-click-copilot-vulnerability-more-than-eight-months-after-learning-of-it.html)
- [NVD - CVE-2026-24301](https://nvd.nist.gov/vuln/detail/CVE-2026-24301)
- [MSRC Security Update Guide - CVE-2026-24301](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24301)
- [Reprompt: The Single-Click Microsoft Copilot Attack that Silently Steals Your Personal Data](https://www.varonis.com/blog/reprompt)
- [SearchLeak: How We Turned M365 Copilot Into a One-Click Data Exfiltration Weapon](https://www.varonis.com/blog/searchleak)
- [Copilot Exposed Its Own Vulnerabilities When Prompted](https://www.securitymagazine.com/articles/102500-copilot-exposed-its-own-vulnerabilities-when-prompted)
- [Microsoft Copilot Leaked Its Own Secret Parameter, Enabling One-Click Data Theft](https://finance.biggo.com/news/51260d52-95b5-4b84-a2f6-711a7738e9f0)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2065