SearchLeak CVE-2026-42824 M365 Copilot Prompt Injection Exfiltration

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•9

Detects potentially malicious or anomalous queries within Microsoft 365 Copilot interactions. The rule monitors for patterns indicating attempts at data exfiltration (e.g., HTML/image embedding, image search parameters), unauthorized information extraction (e.g., email or title extraction), or targeting of sensitive authentication-related information (e.g., OTP or MFA codes).