LegionLoader Bulk SharePoint/OneDrive Access via M365 Copilot Organizational Permissions

Ibrahim Saud@tektrix

•updated Jun 30, 2026•3•0•4

Detects anomalous bulk data access activity within SharePoint or OneDrive where the Microsoft Copilot application is the primary interface. This activity pattern is consistent with SearchLeak-style organizational permission abuse, where an AI assistant may be used to discover and access a large number of distinct files that a user might not otherwise access manually.