New CoPhish attack steals OAuth tokens via Copilot Studio agents

Datadog Security Labs describes a novel phishing technique called 'CoPhish' that abuses Microsoft Copilot Studio agents' demo websites and sign-in topics to present legitimate-looking OAuth consent flows hosted on Microsoft domains; attackers can configure redirect and token-exfiltration actions to steal session tokens (including admin tokens) via HTTP callbacks. The report details the attacker setup and flow, highlights the risk that admins can approve malicious app permissions, and notes Microsoft plans product updates while recommending governance, reduced privileges, and consent policy hardening as mitigations.