New attack turned Microsoft 365 Copilot into 1-click data theft tool
2026-06-15T13:23:31Z•47901235c89983589aadcba8944350183cc37a8adf171cd0ef37140ab3ff58f4
ai-phishingarch-linuxaur-compromisechinese-actorscisaconti-ransomwaredata-theftfbi-takedowninfinite-campusinfostealerivanti-sentrymailboxmicrosoft-365-copilotnovo-nordisk-breachonedriveoutsider-enterprisephpbb-auth-bypassrootkitsalesforcesearchleaksharepointshinyhunterssupply-chain
What happened
This batch covers multiple high-impact security events: a critical vulnerability chain called “SearchLeak” in Microsoft 365 Copilot Enterprise that can exfiltrate mailbox, OneDrive, and SharePoint data via a crafted URL; a Salesforce-related data theft of ~137,000 Infinite Campus school staff accounts claimed by the ShinyHunters gang; the FBI takedown of Outsider Enterprise, a massive AI-powered phishing-as-a-service operation; compromise of 400+ Arch Linux AUR packages distributing a rootkit and infostealer; and other notable incidents including an actively exploited Ivanti Sentry flaw (CISA-
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- bleepingcomputer
- Record identifier
- 47901235c89983589aadcba8944350183cc37a8adf171cd0ef37140ab3ff58f4
- Enrichment time
- 2026-06-15T13:23:31Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.