SearchLeak Copilot Spearphish URL Delivery via Email/Teams to VIP Recipients

Ibrahim Saud@tektrix

•updated Jun 30, 2026•13•0•8

Detects spearphishing attempts using SearchLeak (CVE-2026-42824) which involves delivering malicious Microsoft 365 Copilot Enterprise search URLs. These URLs utilize prompt injection via the query parameter to target high-value users, aiming to exfiltrate sensitive data such as MFA codes, email contents, or meeting details through the Copilot interface.