EchoLeak: Zero-Click Prompt Injection Targeting M365 Copilot for Data Exfiltration

Summary

Aim Security researchers discovered EchoLeak, a zero-click vulnerability in Microsoft 365 Copilot that could allow an attacker to exfiltrate sensitive enterprise data without user interaction. The attack used a prompt injection delivered via an email sent to a target user. When M365 Copilot retrieved the email as part of its retrieval-augmented generation (RAG) context, the malicious instructions caused Copilot to search the user's accessible Microsoft 365 data and include sensitive information in its response context. The sensitive information was then exfiltrated via requests to attacker-controlled URLs without requiring the victim to open the email or click a link. The attack chain bypassed multiple protections, including prompt injection defenses, link redaction, and content security policy restrictions. Microsoft assigned the issue CVE-2025-32711[[cve-2025-32711]]. It has since been remediated with no evidence it was exploited in the wild. Target: Microsoft 365 Copilot Actor: Aim Labs Procedure: 1. The researchers crafted malicious instructions designed to evade Microsoft's indirect prompt injection classifier, appear like ordinary business content, suppress attribution to the attacker-controlled email, and cause Copilot to include sensitive data in rendered output. 2. The researchers embedded the prompt injection in business-like email content that was likely to be retrieved during a later Copilot interaction. The content was designed to appear relevant to ordinary enterprise workflows while carrying hidden instructions. 3. The researchers staged an attacker-controlled web endpoint to receive outbound requests containing encoded sensitive data. The endpoint served as the collection point for the exfiltration channel. 4. The researchers sent the email to a Microsoft 365 user inbox. 5. The prompt was phrased as benign business text rather than and obviously malicious prompt to evade user suspicion. 6. The email was automatically ingested into a RAG database available to Copilot's retrieval pipeline. 7. When the user later invoked Copilot, it retrieved the malicious email into its context and triggering the prompt injection. 8. The malicious instructions caused Copilot to access sensitive enterprise information available through the user's Microsoft 365 account, such as emails, files, or project details.

Deployers

• Microsoft 365 Copilot

Tags

• MITRE ATLAS
• AML.CS0059