2024-07 · 2024-Q3
Microsoft 365 Copilot ASCII Smuggling
Layer tags: not yet tagged.
Target
Microsoft 365 Copilot
Impact
Invisible Unicode characters in hyperlinks exfiltrate emails, MFA codes, and sensitive data
Root Cause
Copilot rendered invisible Unicode characters carrying hidden data payloads in links