SearchLeak: Copilot MFA Mailbox Search via Prompt-Injected URL (CVE-2026-42824)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•3

Detects the SearchLeak (CVE-2026-42824) exploit, where an attacker uses a prompt-injected M365 Copilot URL to force the assistant to search the victim's mailbox for sensitive authentication information such as MFA codes, OTPs, or security passcodes. The rule correlates an external HTTP request containing the malicious URL with a subsequent Exchange search query initiated by the Copilot service within a 2-minute window.