New CoPhish assault steals OAuth tokens by way of Copilot Studio brokers

A brand new phishing approach dubbed ‘CoPhish’ weaponizes Microsoft Copilot Studio brokers to ship fraudulent OAuth consent requests by way of official and trusted Microsoft domains.

The approach was developed by researchers at Datadog Safety Labs, who warned in a report earlier this week that Copilot Studio’s flexibility introduces new, undocumented phishing dangers.

Though CoPhish depends on social engineering, Microsoft has confirmed to BleepingComputer that it plans on fixing the underlying causes in a future replace.

“We have investigated this report and are taking motion to deal with it via future product updates,” a Microsoft spokesperson instructed BleepingComputer.

“Whereas this system depends on social engineering, we stay dedicated to hardening our governance and consent experiences and are evaluating extra safeguards to assist organizations forestall misuse.”

Copilot brokers and OAuth phishing

Copilot Studio brokers are chatbots hosted on copilotstudio.microsoft.com that customers can create and customise via “subjects,” that are workflows that automate particular duties.

Brokers may be shared on Microsoft’s area by enabling the “demo web site” characteristic. As a result of the URL is a official one, it’s simpler for a person to fall for the trick and log in.

The Login matter, which authenticates the person when beginning a dialog with the chatbot, may be configured for particular actions, like requesting a verification code or redirecting to a different location or service.

Katie Knowles, senior safety researcher at Datadog, says that an attacker can customise the Login button with a malicious software that may be “both inner or exterior to the goal surroundings,” and will goal an software admin even they don have entry to the surroundings.

Concentrating on an unprivileged person within the tenant is presently attainable if the risk actor is already current within the surroundings. Nonetheless, when Microsoft’s default coverage adjustments, the assault can be restricted solely to OneNote learn/write permissions and shut the hole for electronic mail, chat, and calendar providers.

Knowles says that even after Microsoft’s replace, it’s nonetheless attainable for an exterior attacker to “goal an Utility Administrator with an externally registered software,” as a result of the adjustments don’t apply to high-privileged roles.

Customers with administrator privileges within the tenant can approve permissions requested by inner or exterior purposes, even when they aren’t verified (e.g. are marked as not being revealed by Microsoft or their group).

The Datadog researcher says {that a} CoPhish assault begins with the risk actor making a malicious multi-tenant app with the sign-in matter configured to direct to the authentication supplier and to gather the session token.

Getting the session token is feasible by configuring an HTTP request to a Burp Collaborator URL and ship the entry token variable in a “token” header.

“The applying ID (or shopper ID), secret, and authentication supplier URLs are used to configure the agent’s sign-in settings,” Knowles says in a report this week.

It needs to be famous that the redirect motion when the sufferer person clicks on the Login button may be configured to redirect to any malicious URL, and the appliance consent workflow URL is only one risk for the attacker.

CoPhish assault on Admins

After activating the malicious agent’s demo web site, an attacker can distribute it to targets in electronic mail phishing campaigns or over Workforce messages.

Because the URL is official and the design of the web page, customers might imagine that it’s simply one other Microsoft Copilot service. Knowles says that one clue that would increase suspicions is the “Microsoft Energy Platform” icon, which is straightforward to overlook.

An admin falling for the trick and accepting the malicious app’s permisssions, are taken to the OAuth redirect URL [token.botframework.com] to validate the bot connection.

“This will appear atypical, however it’s a regular a part of the Copilot Studio authentication course of utilizing a legitimate area,” the Datadog researchers says.

After finishing the authentication course of, the person will obtain no notification about their session token being forwarded to Burp Collaborator and their session being hijacked, however they may be capable to chat with the agent.

Moreover, as a result of the token was despatched from Copilot utilizing Microsoft’s IP addresses, the connection to the attacker won’t present within the person’s net site visitors.

Beneath is a visible overview of how the CoPhish assault works and the steps from the sufferer person accessing the malicious app to the attacker receiving the token.

Microsoft instructed BleepingComputer that clients can shield towards CoPhish assaults by limiting administrative privileges, lowering software permissions, and imposing governance insurance policies.

Datadog offers a set of safety concerns that embody implementing a robust software consent coverage that may cowl any gaps in Microsoft’s default baseline configuration.

The cloud monitoring and safety firm additionally advises organizations to disable person software creation defaults, and intently monitor software consent by way of Entra ID and Copilot Studio agent creation occasions.

46% of environments had passwords cracked, practically doubling from 25% final 12 months.

Get the Picus Blue Report 2025 now for a complete take a look at extra findings on prevention, detection, and knowledge exfiltration developments.

Get the Blue Report 2025