SearchLeak CVE-2026-42824 M365 Copilot Prompt Injection Data Exfiltration

Ibrahim Saud@tektrix

•updated Jun 30, 2026•12•0•11

This rule detects attempts to exploit Microsoft 365 Copilot through prompt injection, where attackers inject HTML/script elements into search queries. It specifically identifies when these queries attempt to force Copilot to interact with external URLs via Bing image search (SSRF), potentially exfiltrating sensitive data such as MFA codes, email content, or meeting details to an attacker-controlled external domain.