SearchLeak CVE-2026-42824 Prompt Injection via M365 Copilot Search q Parameter

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

This rule detects exploitation attempts against Microsoft 365 Copilot (CVE-2026-42824) where attackers inject HTML or malicious prompt sequences into the 'q' query parameter. These payloads aim to perform prompt injection, SSRF via Bing, and cross-site scripting to exfiltrate sensitive data such as mailbox content and MFA tokens.