New CoPhish Attack Exploits Copilot Studio to Exfiltrate OAuth Tokens

A sophisticated phishing technique called CoPhish exploits Microsoft Copilot Studio to trick users into granting attackers unauthorized access to their Microsoft Entra ID accounts. Dubbed by Datadog Security Labs, this method uses customizable AI agents hosted on legitimate Microsoft domains to wrap traditional OAuth consent attacks, making them appear trustworthy and bypassing user suspicions. The […]

The post New CoPhish Attack Exploits Copilot Studio to Exfiltrate OAuth Tokens appeared first on Cyber Security News.