New CoPhish assault steals OAuth tokens through Copilot Studio brokers

A brand new phishing approach dubbed ‘CoPhish’ weaponizes Microsoft Copilot Studio brokers to ship fraudulent OAuth consent requests through respectable and trusted Microsoft domains.

The approach was developed by researchers at Datadog Safety Labs, who warned in a report earlier this week that Copilot Studio’s flexibility introduces new, undocumented phishing dangers.

Though CoPhish depends on social engineering, Microsoft has confirmed to BleepingComputer that it plans on fixing the underlying causes in a future replace.

“We have investigated this report and are taking motion to handle it by way of future product updates,” a Microsoft spokesperson instructed BleepingComputer.

“Whereas this system depends on social engineering, we stay dedicated to hardening our governance and consent experiences and are evaluating further safeguards to assist organizations forestall misuse.”

Copilot brokers and OAuth phishing

Copilot Studio brokers are chatbots hosted on copilotstudio.microsoft.com that customers can create and customise by way of “subjects,” that are workflows that automate particular duties.

Brokers will be shared on Microsoft’s area by enabling the “demo web site” characteristic. As a result of the URL is a respectable one, it’s simpler for a person to fall for the trick and log in.

The Login matter, which authenticates the person when beginning a dialog with the chatbot, will be configured for particular actions, like requesting a verification code or redirecting to a different location or service.

Katie Knowles, senior safety researcher at Datadog, says that an attacker can customise the Login button with a malicious utility that may be “both inner or exterior to the goal atmosphere,” and will goal an utility admin even they don have entry to the atmosphere.

Concentrating on an unprivileged person within the tenant is at present potential if the risk actor is already current within the atmosphere. Nevertheless, when Microsoft’s default coverage adjustments, the assault could be restricted solely to OneNote learn/write permissions and shut the hole for e mail, chat, and calendar companies.

Knowles says that even after Microsoft’s replace, it’s nonetheless potential for an exterior attacker to “goal an Utility Administrator with an externally registered utility,” as a result of the adjustments don’t apply to high-privileged roles.

Customers with administrator privileges within the tenant can approve permissions requested by inner or exterior purposes, even when they aren’t verified (e.g. are marked as not being printed by Microsoft or their group).

The Datadog researcher says {that a} CoPhish assault begins with the risk actor making a malicious multi-tenant app with the sign-in matter configured to direct to the authentication supplier and to gather the session token.

Getting the session token is feasible by configuring an HTTP request to a Burp Collaborator URL and ship the entry token variable in a “token” header.

“The appliance ID (or shopper ID), secret, and authentication supplier URLs are used to configure the agent’s sign-in settings,” Knowles says in a report this week.

It needs to be famous that the redirect motion when the sufferer person clicks on the Login button will be configured to redirect to any malicious URL, and the appliance consent workflow URL is only one risk for the attacker.

CoPhish assault on Admins

After activating the malicious agent’s demo web site, an attacker can distribute it to targets in e mail phishing campaigns or over Workforce messages.

For the reason that URL is respectable and the design of the web page, customers might imagine that it’s simply one other Microsoft Copilot service. Knowles says that one clue that might increase suspicions is the “Microsoft Energy Platform” icon, which is straightforward to overlook.

An admin falling for the trick and accepting the malicious app’s permisssions, are taken to the OAuth redirect URL [token.botframework.com] to validate the bot connection.

“This will appear atypical, nevertheless it’s a regular a part of the Copilot Studio authentication course of utilizing a sound area,” the Datadog researchers says.

After finishing the authentication course of, the person will obtain no notification about their session token being forwarded to Burp Collaborator and their session being hijacked, however they are going to have the ability to chat with the agent.

Moreover, as a result of the token was despatched from Copilot utilizing Microsoft’s IP addresses, the connection to the attacker is not going to present within the person’s net visitors.

Beneath is a visible overview of how the CoPhish assault works and the steps from the sufferer person accessing the malicious app to the attacker receiving the token.

Microsoft instructed BleepingComputer that prospects can defend in opposition to CoPhish assaults by limiting administrative privileges, decreasing utility permissions, and imposing governance insurance policies.

Datadog supplies a set of safety issues that embrace implementing a powerful utility consent coverage that might cowl any gaps in Microsoft’s default baseline configuration.

The cloud monitoring and safety firm additionally advises organizations to disable person utility creation defaults, and intently monitor utility consent through Entra ID and Copilot Studio agent creation occasions.

46% of environments had passwords cracked, practically doubling from 25% final yr.

Get the Picus Blue Report 2025 now for a complete take a look at extra findings on prevention, detection, and knowledge exfiltration developments.

Get the Blue Report 2025