New 'CoPhish' technique wraps OAuth phishing in Microsoft Copilot

A new phishing technique called CoPhish leverages Microsoft Copilot Studio agents and their demo websites to display legitimate-looking OAuth consent/login flows on Microsoft domains, tricking users—including administrators—into approving malicious applications and exposing session/access tokens to attackers; Datadog details the attack flow and mitigations while Microsoft says it will address the issue in future updates.