SearchLeak CSP Bypass: Bing Search-by-Image SSRF Used as M365 Data Exfiltration Proxy

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•7

This rule detects a multi-stage process indicative of Server-Side Request Forgery (SSRF) leveraging Bing's Search-by-Image service. Stage 1 captures browsers submitting arbitrary URLs (via the imgurl= parameter) to Bing. Stage 2 detects subsequent inbound requests to an external, attacker-controlled server originating from Bing's infrastructure, suggesting that Bing performed an unauthorized fetch of a resource and delivered it to the attacker, potentially exfiltrating sensitive data.