This Word Document Steals Your Password From Microsoft Copilot (+ LIVE DEMO)

Microsoft Copilot users can be exploited via malicious documents that inject prompts to poison the AI's memory, enabling persistent data exfiltration through unique font-based side channels 2:15.

Key Takeaways:
• The attacker uses a Word document containing a prompt injection that triggers when the user summarizes the file, bypassing standard security blocks 0:10.
• Data is exfiltrated not through images, but by encoding stolen secrets into the URL of a remote font request, which bypasses Content Security Policies 0:21.
• The exploit leverages "delayed tool invocation" to store malicious instructions in the user's specific Copilot memory, making the attack persistent across future sessions 2:24.
• Once the malicious memory is active, any time the user mentions sensitive keywords like "password," Copilot automatically triggers the font request to leak the data 2:28.
• This technique works across multiple Microsoft 365 apps including Word, Excel, Outlook, and SharePoint, affecting enterprise users globally 1:01.

This vulnerability highlights the critical security risks of persistent AI memory and novel exfiltration vectors that evade traditional detection methods. Organizations must treat AI memory features with the same scrutiny as other data storage mechanisms to prevent silent data breaches.

Sources:

• 2:15 Introduction to persistent data exfiltration in Microsoft Copilot.
• 0:21 Explanation of font-based CSP bypass for data leakage.
• 2:24 Demonstration of storing malicious payloads in user memory.
• 2:28 Triggering the exploit via specific keywords in future conversations.
• 1:01 Scope of the vulnerability across various Microsoft 365 applications.
• 14:00 Live demo of the data exfiltration workflow in Outlook.