The EchoLeak attack is a critical zero-click vulnerability (CVE-2025-32711) discovered in Microsoft 365 Copilot, enabling attackers to silently exfiltrate sensitive organizational data without any user interaction. Here’s how EchoLeak Works
1. Malicious Email Injection: Attackers send a specially crafted email disguised as a business document. The email contains hidden prompt injections that bypass Microsoft’s cross-prompt injection attack (XPIA) classifiers.
2. Retrieval-Augmented Generation (RAG) Exploit: When the victim later interacts with Copilot (e.g., asking a business-related question), the RAG engine retrieves the malicious email into the AI’s context due to its formatting and apparent relevance.
3. LLM Scope Violation: The injected prompt tricks the AI into accessing privileged data (e.g., chat histories, OneDrive files, Teams conversations) and embedding it into a markdown image or link. The browser automatically requests the image, sending the stolen data to the attacker’s server.
4. Exfiltration via Trusted Domains: Microsoft’s Content Security Policy (CSP) blocks most external domains, but attackers abuse trusted Microsoft URLs (e.g., SharePoint, Teams) to evade detection