New CoPhish assault steals OAuth tokens by way of Copilot Studio brokers

A brand new phishing approach dubbed ‘CoPhish’ weaponizes Microsoft Copilot Studio brokers to ship fraudulent OAuth consent requests by way of reliable and trusted Microsoft domains.

The approach was developed by researchers at Datadog Safety Labs, who warned in a report earlier this week that Copilot Studio’s flexibility introduces new, undocumented phishing dangers.

Though CoPhish depends on social engineering, Microsoft has confirmed to BleepingComputer that it plans on fixing the underlying causes in a future replace.

“We have investigated this report and are taking motion to deal with it by way of future product updates,” a Microsoft spokesperson instructed BleepingComputer.

“Whereas this system depends on social engineering, we stay dedicated to hardening our governance and consent experiences and are evaluating extra safeguards to assist organizations stop misuse.”

Copilot brokers and OAuth phishing

Copilot Studio brokers are chatbots hosted on copilotstudio.microsoft.com that customers can create and customise by way of “matters,” that are workflows that automate particular duties.

Brokers could be shared on Microsoft’s area by enabling the “demo web site” function. As a result of the URL is a reliable one, it’s simpler for a person to fall for the trick and log in.

The Login matter, which authenticates the person when beginning a dialog with the chatbot, could be configured for particular actions, like requesting a verification code or redirecting to a different location or service.

Katie Knowles, senior safety researcher at Datadog, says that an attacker can customise the Login button with a malicious utility that may be “both inside or exterior to the goal surroundings,” and will goal an utility admin even they don have entry to the surroundings.

Concentrating on an unprivileged person within the tenant is at the moment potential if the risk actor is already current within the surroundings. Nonetheless, when Microsoft’s default coverage modifications, the assault can be restricted solely to OneNote learn/write permissions and shut the hole for e mail, chat, and calendar companies.

Knowles says that even after Microsoft’s replace, it’s nonetheless potential for an exterior attacker to “goal an Utility Administrator with an externally registered utility,” as a result of the modifications don’t apply to high-privileged roles.

Customers with administrator privileges within the tenant can approve permissions requested by inside or exterior functions, even when they aren’t verified (e.g. are marked as not being printed by Microsoft or their group).

The Datadog researcher says {that a} CoPhish assault begins with the risk actor making a malicious multi-tenant app with the sign-in matter configured to direct to the authentication supplier and to gather the session token.

Getting the session token is feasible by configuring an HTTP request to a Burp Collaborator URL and ship the entry token variable in a “token” header.

“The appliance ID (or consumer ID), secret, and authentication supplier URLs are used to configure the agent’s sign-in settings,” Knowles says in a report this week.

It ought to be famous that the redirect motion when the sufferer person clicks on the Login button could be configured to redirect to any malicious URL, and the appliance consent workflow URL is only one risk for the attacker.

CoPhish assault on Admins

After activating the malicious agent’s demo web site, an attacker can distribute it to targets in e mail phishing campaigns or over Group messages.

For the reason that URL is reliable and the design of the web page, customers might imagine that it’s simply one other Microsoft Copilot service. Knowles says that one clue that would increase suspicions is the “Microsoft Energy Platform” icon, which is straightforward to overlook.

An admin falling for the trick and accepting the malicious app’s permisssions, are taken to the OAuth redirect URL [token.botframework.com] to validate the bot connection.

“This may increasingly appear atypical, but it surely’s a regular a part of the Copilot Studio authentication course of utilizing a sound area,” the Datadog researchers says.

After finishing the authentication course of, the person will obtain no notification about their session token being forwarded to Burp Collaborator and their session being hijacked, however they’ll have the ability to chat with the agent.

Moreover, as a result of the token was despatched from Copilot utilizing Microsoft’s IP addresses, the connection to the attacker is not going to present within the person’s net site visitors.

Under is a visible overview of how the CoPhish assault works and the steps from the sufferer person accessing the malicious app to the attacker receiving the token.

Microsoft instructed BleepingComputer that prospects can shield towards CoPhish assaults by limiting administrative privileges, lowering utility permissions, and implementing governance insurance policies.

Datadog offers a set of safety issues that embody implementing a powerful utility consent coverage that might cowl any gaps in Microsoft’s default baseline configuration.

The cloud monitoring and safety firm additionally advises organizations to disable person utility creation defaults, and intently monitor utility consent by way of Entra ID and Copilot Studio agent creation occasions.

46% of environments had passwords cracked, practically doubling from 25% final yr.

Get the Picus Blue Report 2025 now for a complete have a look at extra findings on prevention, detection, and information exfiltration traits.

Get the Blue Report 2025