SearchLeak CVE-2026-42824: M365 Copilot One-Click Exfiltration via Bing SSRF Proxy

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•4

Detects potential data exfiltration from Microsoft 365 Copilot sessions where the Bing 'Search by Image' functionality is abused as an SSRF proxy. The rule identifies network requests containing external URLs within the 'imgurl' parameter, occurring shortly after Copilot activity, suggesting that internal or sensitive data (such as emails, calendar items, or MFA context) is being transmitted to an unauthorized external endpoint.