CoSnitch: Microsoft Copilot Personal One-Click Data Exfiltration — Detection and Remediation Guide

Varonis Threat Labs has disclosed a set of three vulnerabilities in Microsoft Copilot Personal, collectively named CoSnitch, that allow an attacker to exfiltrate data from a victim's connected applications with a single click. The attack requires nothing more than getting a target to click a crafted link — no malware drop, no credential phishing page, no endpoint payload. Once clicked, the link silently instructs the victim's own Copilot session to pull data from connected apps and other information available to that session and return it to the attacker.

This matters because of where Copilot Personal sits in the modern workspace. Users connect it to email, files, calendars, and third-party SaaS applications precisely so it can act on their data. That convenience is the attack surface. A single assistant session can aggregate mailbox contents, OneDrive files, and connected-app data — exactly the crown jewels an intruder would otherwise need an endpoint foothold to reach. CoSnitch collapses that entire intrusion chain into one URL.

Notably, part of the attack chain relies on an undocumented URL parameter that Copilot itself surfaced to the researchers — the assistant effectively revealed its own exploitation primitive. That detail should concern every defender running AI assistants in production: these platforms can leak their own internal mechanics to anyone who asks the right way.

No CVE identifiers or CVSS scores have been published for the three CoSnitch flaws at the time of this writing, and Varonis reports it coordinated disclosure with Microsoft. There are no confirmed reports of in-the-wild exploitation — but the technique is now public, and the barrier to weaponization is low. Treat this as an urgent configuration-review and detection-engineering exercise, not a patching queue item.

Technical Analysis

Affected Product

• Microsoft Copilot Personal — the consumer/personal-tier assistant experience (copilot.microsoft.com and associated surfaces), distinct from Microsoft 365 Copilot in the enterprise tenant context, though the underlying technique class (assistant-mediated data access via crafted URLs) should be evaluated against any Copilot deployment with connectors enabled.
• The risk surface scales with connected apps: any application or data source the victim has linked to their Copilot session becomes exfiltratable content.

How the Attack Works (Defender's View)

Based on the Varonis disclosure, the CoSnitch chain works as follows:

1. Delivery: The victim receives a crafted link — via email, chat, SMS, or a malicious page. This is a pure social-engineering delivery; the link itself is the entire payload.
2. Invocation: Clicking the link opens Copilot Personal with attacker-controlled parameters embedded in the URL. One of these is an undocumented URL parameter that influences the assistant's behavior — a parameter Copilot itself disclosed to the researchers during testing.
3. Instruction smuggling: The crafted URL effectively primes the Copilot session with attacker instructions (a prompt-injection-by-URL pattern), directing the assistant to query connected applications and data available to the victim's authenticated session.
4. Exfiltration: The retrieved data is sent out — silently, from the victim's perspective — using the assistant's own rendering/request mechanisms (e.g., instructing the assistant to embed or request an attacker-controlled resource containing the data). The victim sees a normal-looking Copilot interaction; the data has already left.

Key defensive takeaways from the mechanics:

• The victim's browser and authenticated session are the execution environment. There is no malicious binary, so traditional EDR process-lineage detections won't fire. The observable artifacts are: (a) the inbound malicious link, (b) navigation to Copilot domains with anomalous query strings, and (c) assistant-originated outbound requests to attacker infrastructure.
• Connected-app permissions are the blast radius. An account with minimal or no connected apps presents a far smaller prize than one wired into mail, storage, and CRM.
• Undocumented parameters are a recurring AI-platform risk. Expect more of this class of bug as assistants expose debugging, state, or orchestration parameters that were never threat-modeled as user-facing input.

Exploitation Status

• CVE / CVSS: None published at disclosure time.
• CISA KEV: Not listed.
• In-the-wild exploitation: None confirmed. Working proof-of-concept demonstrated by Varonis Threat Labs under coordinated disclosure.
• Assessment: The technique requires only a link click and a victim with connected apps. Once public, replication by phishers and red teams is trivial. Assume adversaries are experimenting now.

Detection & Response

The honest challenge here: this is a client-side, browser-resident attack against a cloud AI service. Your best telemetry is (1) the link at delivery time (email/web gateway), (2) browser navigation to Copilot URLs with suspicious query strings, and (3) Copilot processes making unexpected outbound connections. The detections below focus on those three observable planes.

SIGMA Rules

---
title: Browser Launched With Crafted Microsoft Copilot URL Containing Query Parameters
id: 3f7a2c19-8d4e-4b61-a9f2-5c1e7d8b3a04
status: experimental
description: Detects browser processes launched via URL handler with copilot.microsoft.com URLs carrying query string parameters. One-click exfiltration attacks like CoSnitch deliver crafted Copilot URLs with embedded instruction-bearing parameters; legitimate Copilot launches rarely carry deep query strings from external referrers.
references:
  - https://thehackernews.com/2026/08/microsoft-copilot-personal-flaws-could.html
  - https://attack.mitre.org/techniques/T1204/001/
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.initial_access
  - attack.t1204.001
  - attack.exfiltration
logsource:
  category: process_creation
  product: windows
detection:
  selection_browser:
    Image|endswith:
      - '\msedge.exe'
      - '\chrome.exe'
      - '\firefox.exe'
      - '\brave.exe'
  selection_url:
    CommandLine|contains:
      - 'copilot.microsoft.com/?'
      - 'copilot.microsoft.com/chats/?'
      - 'www.bing.com/chat?'
  filter_single_click:
    CommandLine|contains: '--single-argument'
  condition: selection_browser and selection_url and not filter_single_click
falsepositives:
  - Users legitimately sharing Copilot conversation links
  - Microsoft marketing emails linking to Copilot with tracking parameters
level: medium
---
title: Copilot or Browser Process Outbound Connection to Uncommon External Domain
id: 8b1d4e62-2f5a-4c93-b7e1-9a3c6f0d2e58
status: experimental
description: Detects the Copilot desktop application or a browser process with an active Copilot tab establishing connections to rare non-Microsoft domains. CoSnitch-style exfiltration relies on the assistant session issuing requests to attacker-controlled infrastructure to carry the stolen data.
references:
  - https://thehackernews.com/2026/08/microsoft-copilot-personal-flaws-could.html
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.exfiltration
  - attack.t1041
logsource:
  category: network_connection
  product: windows
detection:
  selection_process:
    Image|endswith:
      - '\Copilot.exe'
      - '\msedgewebview2.exe'
  filter_microsoft:
    DestinationHostname|endswith:
      - '.microsoft.com'
      - '.bing.com'
      - '.live.com'
      - '.office.com'
      - '.microsoftonline.com'
      - '.windows.net'
      - '.azure.com'
      - '.msftconnecttest.com'
  condition: selection_process and not filter_microsoft
falsepositives:
  - CDN endpoints resolving to non-Microsoft hostnames
  - Legitimate third-party connector traffic when connected apps are configured
level: medium
---
title: Suspicious URL Pattern in Copilot Link Referrers Delivered via Email Clients
id: c4e9a1d7-6b2f-4a85-9d03-1f7c5e8b6a21
status: experimental
description: Detects mail client or browser processes spawning navigation to Copilot URLs with lengthy encoded query strings, a pattern consistent with instruction-smuggling links of the type used in CoSnitch.
references:
  - https://thehackernews.com/2026/08/microsoft-copilot-personal-flaws-could.html
  - https://attack.mitre.org/techniques/T1566/002/
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.initial_access
  - attack.t1566.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'copilot.microsoft.com'
    CommandLine|contains:
      - '%20'
      - 'q='
      - 'prompt='
      - 'text='
  condition: selection
falsepositives:
  - Shared Copilot prompts from internal documentation or training material
level: low

A note on fidelity: rule one and three will fire on legitimate shared Copilot links — that is expected at medium/low level. The value is correlation: a Copilot-URL navigation event followed within minutes by assistant-originated connections to a first-seen domain is a high-confidence CoSnitch pattern. Tune the Microsoft-domain filter list to your egress reality before enabling rule two broadly.

KQL — Microsoft Sentinel / Defender

This hunt correlates the two halves of the attack: a Copilot URL navigation with query parameters, followed by an outbound connection from the same device to a domain the organization has never contacted before.

let lookback = 7d;
let copilot_navs =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName in~ ("msedge.exe", "chrome.exe", "firefox.exe", "brave.exe")
    | where ProcessCommandLine has_any ("copilot.microsoft.com/?", "copilot.microsoft.com/chats", "bing.com/chat?")
    | where ProcessCommandLine has_any ("q=", "prompt=", "text=", "%20", "%22")
    | project NavTime=TimeGenerated, DeviceId, DeviceName, AccountName, ProcessCommandLine;
let rare_egress =
    DeviceNetworkEvents
    | where TimeGenerated > ago(lookback)
    | where InitiatingProcessFileName in~ ("Copilot.exe", "msedgewebview2.exe", "msedge.exe", "chrome.exe")
    | where RemoteUrl !has_any ("microsoft.com", "bing.com", "live.com", "office.com", "microsoftonline.com", "windows.net", "azure.com", "msn.com")
    | summarize FirstSeen=min(TimeGenerated), ConnectionCount=count() by DeviceId, RemoteUrl
    | where FirstSeen > ago(lookback - 1d);  // domain first contacted recently
copilot_navs
| join kind=inner (
    DeviceNetworkEvents
    | where TimeGenerated > ago(lookback)
    | project ConnTime=TimeGenerated, DeviceId, RemoteUrl, RemoteIP, InitiatingProcessFileName
) on DeviceId
| where ConnTime between (NavTime .. NavTime + 30m)
| join kind=inner rare_egress on DeviceId, RemoteUrl
| project NavTime, ConnTime, DeviceName, AccountName, RemoteUrl, RemoteIP, InitiatingProcessFileName, ProcessCommandLine
| order by NavTime desc;

If you ingest web proxy or Defender for Office 365 URL telemetry, also hunt the delivery vector — inbound emails containing Copilot URLs with query strings:

EmailUrlInfo
| where TimeGenerated > ago(14d)
| where Url has "copilot.microsoft.com" and Url has "?"
| join kind=inner (EmailEvents | where TimeGenerated > ago(14d) | project NetworkMessageId, SenderFromAddress, Subject, DeliveryAction) on NetworkMessageId
| summarize by SenderFromAddress, Subject, Url, DeliveryAction
| order by SenderFromAddress asc;

Velociraptor VQL

For endpoint triage on a suspected victim, pull browser history for Copilot URL visits with query strings — this establishes whether the click occurred and which parameters were delivered.

-- Triage: find Copilot URL visits with query parameters in Chrome/Edge history
-- Indicates whether a crafted CoSnitch-style link was actually opened
SELECT * FROM foreach(
  row={
    SELECT FullPath FROM glob(globs='C:/Users/*/AppData/Local/*/Chrome/User Data/*/History')
  },
  query={
    SELECT * FROM Artifact.Windows.Forensics.CopilotHistoryCheck()
  })

-- Simpler alternative: live processes currently holding Copilot URLs
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)copilot\.microsoft\.com.*[?&](q|prompt|text)='
   OR CommandLine =~ '(?i)bing\.com/chat\?'

-- Network check: Copilot/WebView processes talking to non-Microsoft hosts
SELECT Pid, Name, Path, Status, Family, Type,
       Laddr, Lport, Raddr, Rport
FROM netstat()
WHERE Name =~ '(?i)copilot|msedgewebview2'
  AND Status = 'ESTABLISHED'
  AND Raddr !~ '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)'

(The custom artifact reference is illustrative — substitute Windows.Forensics.BrowserHistory or your history-parsing artifact of choice and filter Url =~ 'copilot.microsoft.com.*\\?'.)

Remediation & Hardening Script

There is no endpoint patch to deploy for a cloud-side AI flaw, but you can materially shrink the attack surface today: restrict Copilot on managed endpoints where it isn't business-justified, audit connected apps, and verify policy state. Run this as a compliance check across the fleet.

# CoSnitch exposure reduction — audit and harden Windows endpoints
# Run elevated. Test in a pilot OU before broad enforcement.

$results = [ordered]@{}

# 1. Disable Windows Copilot via policy where not business-required
$copilotPolicy = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot'
if (-not (Test-Path $copilotPolicy)) { New-Item -Path $copilotPolicy -Force | Out-Null }
Set-ItemProperty -Path $copilotPolicy -Name 'TurnOffWindowsCopilot' -Value 1 -Type DWord
$results['CopilotPolicySet'] = (Get-ItemProperty -Path $copilotPolicy -Name 'TurnOffWindowsCopilot').TurnOffWindowsCopilot -eq 1

# 2. Check per-user Copilot app presence (auditing — removal is a business decision)
$apps = Get-AppxPackage -AllUsers -Name '*Copilot*' -ErrorAction SilentlyContinue
$results['CopilotAppxInstalled'] = [bool]$apps
if ($apps) { $apps | Select-Object Name, PackageFullName | Format-Table }

# 3. Edge policy: block HubsSidebar (reduces Copilot surface in the browser)
$edgePolicy = 'HKLM:\SOFTWARE\Policies\Microsoft\Edge'
if (-not (Test-Path $edgePolicy)) { New-Item -Path $edgePolicy -Force | Out-Null }
Set-ItemProperty -Path $edgePolicy -Name 'HubsSidebarEnabled' -Value 0 -Type DWord
$results['EdgeSidebarDisabled'] = (Get-ItemProperty -Path $edgePolicy -Name 'HubsSidebarEnabled').HubsSidebarEnabled -eq 0

# 4. Export current state for compliance evidence
$results | ConvertTo-Json | Out-File "$env:ProgramData\CoSnitch-Hardening-$(Get-Date -Format yyyyMMdd).json"
$results

Remediation

1. Track the Microsoft advisory. Varonis coordinated disclosure with Microsoft; monitor the Microsoft Security Response Center and the Varonis disclosure write-up for the fix status of each of the three flaws and any assigned CVEs. Cloud-side mitigations will ship server-side — confirm with Microsoft (via your TAM or support channel) that your tenant/region has received the mitigations.
2. Audit and prune connected apps immediately. This is the single highest-leverage action: every connected data source is exfiltration scope. Inventory which users have linked mail, storage, and third-party SaaS to Copilot Personal; revoke anything not business-justified. For consumer accounts used on corporate devices, prefer blocking Copilot Personal entirely via policy (script above) or Conditional Access / app governance controls.
3. Enforce link protection at delivery. Ensure Defender for Office 365 Safe Links (or your SEG's URL rewriting) covers all inbound mail and Teams/chat messages, and add detonation/reputation scrutiny for URLs pointing at AI assistant domains with query strings.
4. Deploy the detections above and establish a baseline of legitimate Copilot URL sharing in your environment so the medium/low-severity rules don't drown the queue. Correlate navigation + rare egress for high-fidelity alerting.
5. User awareness, but scoped. "Don't click links" is not a control. The actionable message: Copilot links received via email or chat should be treated with the same suspicion as credential-phishing URLs — verify the sender out-of-band before opening.
6. Governance lesson for your AI roadmap. Any assistant you deploy with connector access to enterprise data inherits this threat class. Require, in procurement and architecture review: documented URL parameter surface, prompt-injection resistance testing, and the ability to log/alert on assistant-originated external requests.

No CISA KEV entry or remediation deadline exists for CoSnitch as of publication. Given the one-click, malware-free nature of the attack, do not wait for a KEV listing to act on items 2 and 3.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub