A brand new phishing approach dubbed ‘CoPhish’ weaponizes Microsoft Copilot Studio brokers to ship fraudulent OAuth consent requests by way of professional and trusted Microsoft domains.
The approach was developed by researchers at Datadog Safety Labs, who warned in a report earlier this week that Copilot Studio’s flexibility introduces new, undocumented phishing dangers.
Though CoPhish depends on social engineering, Microsoft has confirmed to BleepingComputer that it plans on fixing the underlying causes in a future replace.
“We have investigated this report and are taking motion to deal with it by way of future product updates,” a Microsoft spokesperson informed BleepingComputer.
“Whereas this system depends on social engineering, we stay dedicated to hardening our governance and consent experiences and are evaluating extra safeguards to assist organizations stop misuse.”
Copilot brokers and OAuth phishing
Copilot Studio brokers are chatbots hosted on copilotstudio.microsoft.com that customers can create and customise by way of “subjects,” that are workflows that automate particular duties.
Brokers will be shared on Microsoft’s area by enabling the “demo web site” function. As a result of the URL is a professional one, it’s simpler for a consumer to fall for the trick and log in.
The Login matter, which authenticates the consumer when beginning a dialog with the chatbot, will be configured for particular actions, like requesting a verification code or redirecting to a different location or service.
supply: Datadog
Katie Knowles, senior safety researcher at Datadog, says that an attacker can customise the Login button with a malicious utility that may be “both inner or exterior to the goal setting,” and will goal an utility admin even they don have entry to the setting.
Focusing on an unprivileged consumer within the tenant is at present potential if the risk actor is already current within the setting. Nevertheless, when Microsoft’s default coverage adjustments, the assault could be restricted solely to OneNote learn/write permissions and shut the hole for electronic mail, chat, and calendar providers.
Knowles says that even after Microsoft’s replace, it’s nonetheless potential for an exterior attacker to “goal an Utility Administrator with an externally registered utility,” as a result of the adjustments don’t apply to high-privileged roles.
Customers with administrator privileges within the tenant can approve permissions requested by inner or exterior purposes, even when they aren’t verified (e.g. are marked as not being printed by Microsoft or their group).
The Datadog researcher says {that a} CoPhish assault begins with the risk actor making a malicious multi-tenant app with the sign-in matter configured to direct to the authentication supplier and to gather the session token.
Getting the session token is feasible by configuring an HTTP request to a Burp Collaborator URL and ship the entry token variable in a “token” header.
Supply: Datadog
“The applying ID (or shopper ID), secret, and authentication supplier URLs are used to configure the agent’s sign-in settings,” Knowles says in a report this week.
It ought to be famous that the redirect motion when the sufferer consumer clicks on the Login button will be configured to redirect to any malicious URL, and the appliance consent workflow URL is only one risk for the attacker.
CoPhish assault on Admins
After activating the malicious agent’s demo web site, an attacker can distribute it to targets in electronic mail phishing campaigns or over Crew messages.
For the reason that URL is professional and the design of the web page, customers might imagine that it’s simply one other Microsoft Copilot service. Knowles says that one clue that would increase suspicions is the “Microsoft Energy Platform” icon, which is straightforward to overlook.
Supply: Datadog
An admin falling for the trick and accepting the malicious app’s permisssions, are taken to the OAuth redirect URL [token.botframework.com] to validate the bot connection.
“This will appear atypical, but it surely’s a normal a part of the Copilot Studio authentication course of utilizing a legitimate area,” the Datadog researchers says.
After finishing the authentication course of, the consumer will obtain no notification about their session token being forwarded to Burp Collaborator and their session being hijacked, however they may be capable to chat with the agent.
Moreover, as a result of the token was despatched from Copilot utilizing Microsoft’s IP addresses, the connection to the attacker won’t present within the consumer’s internet site visitors.
Beneath is a visible overview of how the CoPhish assault works and the steps from the sufferer consumer accessing the malicious app to the attacker receiving the token.
.jpg)
Supply: Datadog
Microsoft informed BleepingComputer that prospects can defend in opposition to CoPhish assaults by limiting administrative privileges, decreasing utility permissions, and imposing governance insurance policies.
Datadog gives a set of safety issues that embrace implementing a powerful utility consent coverage that might cowl any gaps in Microsoft’s default baseline configuration.
The cloud monitoring and safety firm additionally advises organizations to disable consumer utility creation defaults, and carefully monitor utility consent by way of Entra ID and Copilot Studio agent creation occasions.
46% of environments had passwords cracked, practically doubling from 25% final 12 months.
Get the Picus Blue Report 2025 now for a complete take a look at extra findings on prevention, detection, and information exfiltration traits.
