New attack turned Microsoft 365 Copilot into 1-click data theft tool

Varonis disclosed 'SearchLeak' (CVE-2026-42824), a critical chained vulnerability in Microsoft 365 Copilot Enterprise that lets an attacker craft a URL which instructs Copilot Search to retrieve sensitive content (emails, calendar items, OneDrive/SharePoint documents), embed that content in an image URL, and use Bing’s image fetch (SSRF) to exfiltrate the data; Microsoft has patched the issue and no mitigation action by users is required.