Security researchers from Varonis Threat Labs disclose a vulnerability chain, dubbed “SearchLeak,” affecting Microsoft 365 Copilot Enterprise Search. They describe how an attacker can exploit a crafted, single-click URL that appears to be hosted on a legitimate microsoft.com domain. Because the link uses a real Microsoft domain, the researchers say common anti-phishing and URL filtering approaches would be less effective.
In the described scenario, the one-click flow can be used to exfiltrate information from a target’s Microsoft 365 environment. The reported data includes emails and calendar details, as well as information from indexed files accessed through Copilot Enterprise Search. One report also notes the possibility of obtaining multi-factor authentication (MFA) codes as part of the chain.
Across the coverage, the key point is that the issue is not presented as a single isolated bug, but as multiple linked weaknesses that together enable data theft through a trusted link. The outlets report the researchers’ findings and naming of the attack path but do not indicate in the provided text which specific Microsoft components or mitigations were applied or when the vulnerability was fixed.
