SearchLeak CVE-2026-42824 Browser Copilot-to-Bing Exfil Chain

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•12

Detects a potential SSRF-based exfiltration attempt by correlating DNS traffic. The rule identifies a browser session that accesses M365 Copilot (m365.cloud.microsoft) followed by a connection to Bing (bing.com), which is indicative of the exfiltration technique associated with CVE-2026-42824 involving the Bing 'searchbyimage' feature.