SearchLeak: How a microsoft.com Link Could Have Drained a Copilot Tenant

A click on a real microsoft.com link should not empty your inbox. For a window of time, against Microsoft 365 Copilot Enterprise Search, it could.

Varonis Threat Labs is calling the chain SearchLeak. They strung three bugs together into a one-click data theft route that pulled mail, calendar entries, and anything Copilot had already indexed for the victim's tenant. Because the lure resolved to a legitimate Microsoft domain, URL reputation engines and the usual phishing filters had nothing to bite on.

If that pattern sounds familiar, it should. This is open-redirect-meets-SSRF logic wearing a Copilot badge. The novelty is not the primitive. The novelty is what sits behind the trusted hostname: a retrieval system with privileged access to every document, message, and meeting the user can see.

That is the part worth dwelling on.

Enterprise Search in Copilot is essentially a pre-authenticated oracle over a user's Graph data. Hand an attacker even a narrow query channel into that oracle and the blast radius is not one mailbox — it is everything the index has chewed through. Emails. Calendar invites. SharePoint files. Whatever else got hoovered in during onboarding.

The one-click delivery is the other half of the problem. Defenders have spent a decade training users to check the domain bar. SearchLeak punishes anyone who took that advice literally. The link is microsoft.com. The destination is hostile. Same story as classic OAuth consent phishing, same story as Azure AD app-registration abuse, just with a Copilot twist.

Varonis reported the chain to Microsoft, which has since fixed the underlying issues server-side. There is no patch for customers to deploy and, per the disclosure, no evidence of exploitation in the wild. Tenants do not need to roll credentials over this one.

They should still draw the lesson.

A few things worth doing now, regardless of SearchLeak specifically:

• Audit what Copilot Enterprise Search has actually indexed in your tenant. Most admins underestimate this by a lot.
• Treat Copilot and other RAG-style assistants as a sensitive data sink in your DLP and insider-risk models, not as a productivity feature.

The broader pattern is not going away. Any AI assistant that combines broad read scopes with a web-facing surface is a high-value target, and any bug that turns its retrieval layer into an attacker-controlled query is going to be worth chaining. SearchLeak is the cleanest public example so far. It will not be the last.

The interesting research question is whether vendors start treating retrieval indices the way the industry eventually learned to treat session cookies: as crown-jewel material that needs its own threat model, not a side effect of a feature ship.