← Catalog
Incident critical discovered 2025-06-11

EchoLeak: Zero-Click Data Exfiltration from Microsoft 365 Copilot

A single crafted email — no clicks required — planted hidden instructions that Microsoft 365 Copilot ingested from context, then abused trusted markdown image rendering to exfiltrate internal data to an attacker server. The first documented zero-click exploit of a production LLM assistant.

Execution Initial Access Persistence Defense Evasion Exfiltration

What happened

Aim Security disclosed EchoLeak (CVE-2025-32711, CVSS 9.3) in June 2025 — the first publicly documented zero-click attack on a production LLM assistant. An attacker sends a Microsoft 365 user an ordinary-looking email containing a hidden prompt payload (an HTML comment, or white-on-white text). The user never has to open or act on it: when they later ask Copilot something and the assistant’s retrieval pulls that email into context, the planted instructions are interpreted as commands.

The payload steers Copilot to gather sensitive content from the user’s accessible data (files, emails, Teams) and leak it out through a markdown image reference — Copilot renders the image, the client fetches the attacker-controlled URL, and the exfiltrated data rides along in the URL path. Microsoft patched it server-side and reported no in-the-wild exploitation.

Why it maps to ATLAS

  • AML.T0051.001 — LLM Prompt Injection: Indirect: instructions arrive through retrieved content, not the user’s prompt.
  • AML.T0093 — Prompt Infiltration via Public-Facing Application: the email channel is the public entry point into the assistant’s context.
  • AML.T0067 — LLM Trusted Output Components Manipulation: the exfil abuses trusted markdown/image rendering in the client.
  • AML.T0025 — Exfiltration via Cyber Means: data leaves via the auto-loaded image URL.

Detection notes

The prompt is clean; the poison is in the retrieval channel and the exfil is in the output rendering. Watch both boundaries: imperative language inside retrieved documents, and model output that emits URLs/images whose path encodes conversation or file content and points outside the tenant. The durable fix is architectural — untrusted content must never be allowed to both instruct the model and trigger outbound rendering.

Detection

Log sources

  • Copilot / Graph retrieval context logs
  • Outbound URL fetch + image-proxy logs
  • Inbound mail with hidden HTML (white-on-white text, HTML comments)

Signals

  • Retrieved email/document content containing imperative instructions to Copilot
  • Markdown/image URLs in model output whose path encodes conversation or file content
  • Copilot egress to a domain outside the tenant's expected set

Mitigations

  • Treat retrieved content as untrusted data; strip/neutralize instructions before context assembly
  • Block or proxy external image/URL rendering in assistant output; allowlist egress
  • Scope the assistant's retrieval to least-privilege data sources per request