SearchLeak CSP Bypass - Bing Search-by-Image SSRF Exfil from Browser

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•6

Detects browser processes performing DNS resolution for Bing search endpoints immediately following access to M365 Copilot services within the same process storyline. This pattern is indicative of a SearchLeak exploitation chain where an adversary leverages M365 Copilot search to perform SSRF, using Bing as a proxy for data exfiltration.