FlagThis

ImgSrc: socprime.com

References :

• cyberinsider.com: EchoLeak Zero-Click AI Attack in Microsoft Copilot Exposes Company Data
• www.cybersecuritydive.com: Critical flaw in Microsoft Copilot could have allowed zero-click attack
• CyberInsider: Researchers at Aim Labs have unveiled EchoLeak, a critical zero-click vulnerability in Microsoft 365 Copilot that allows attackers to exfiltrate sensitive organizational data without any user interaction.
• hackread.com: Zero-Click AI Vulnerability Exposes Microsoft 365 Copilot Data Without User Interaction
• SOC Prime Blog: Researchers have recently uncovered CVE-2025-32711, dubbed “EchoLeakâ€, a critical vulnerability in Microsoft’s Copilot AI that lets attackers steal sensitive data via email, without any user interaction.
• The Hacker News: Zero-Click AI Vulnerability Exposes Microsoft 365 Copilot Data Without User Interaction
• socprime.com: CVE-2025-32711 Vulnerability: “EchoLeak†Flaw in Microsoft 365 Copilot Could Enable a Zero-Click Attack on an AI Agent
• www.csoonline.com: First-ever zero-click attack targets Microsoft 365 Copilot
• cyberpress.org: Zero-Click Microsoft 365 Copilot Vulnerability Allows Attackers to Exfiltrate Sensitive Data via Teams
• www.scworld.com: Microsoft 365 Copilot ‘zero-click’ vulnerability enabled data exfiltration
• www.techradar.com: Microsoft Copilot targeted in first “zero-click†attack on an AI agent - what you need to know
• ciso2ciso.com: Microsoft 365 Copilot: New Zero-Click AI Vulnerability Allows Corporate Data Theft – Source: www.infosecurity-magazine.com
• the-decoder.com: Microsoft struggled with critical Copilot vulnerability for months
• www.windowscentral.com: Microsoft Copilot's own default configuration exposed users to the first-ever zero-click AI attack, but there was no data breach
• siliconangle.com: A new report out today from Aim Security Ltd. reveals the first known zero-click artificial intelligence vulnerability that could have allowed attackers to exfiltrate sensitive internal data without any user action.
• SiliconANGLE: Aim Security details first known AI zero-click exploit targeting Microsoft 365 Copilot
• THE DECODER: A major security flaw in Microsoft 365 Copilot allowed attackers to access sensitive company data with nothing more than a specially crafted email—no clicks or user interaction required. The vulnerability, named "EchoLeak," was uncovered by cybersecurity firm Aim Security.
• BleepingComputer: Bleeping Computer: Zero-click AI data leak flaw uncovered in Microsoft 365 Copilot
• Simon Willison's Weblog: Breaking down ‘EchoLeak’, the First Zero-Click AI Vulnerability Enabling Data Exfiltration from Microsoft 365 Copilot
• securityboulevard.com: Aim Security researchers found a zero-click vulnerability in Microsoft 365 Copilot that could have been exploited to have AI tools like RAG and AI agents hand over sensitive corporate data to attackers simply by issuing a request for the information in a specially worded email.
• ai-techpark.com: Unique AI Vulnerability Research Yields Breakthrough ‘EchoLeak’ Discovery: First Zero-Click AI Vulnerability in Microsoft 365 Copilot
• Daily CyberSecurity: EchoLeak: First AI Zero-Click Vulnerability Leaks Data from Microsoft 365 Copilot
• Security Risk Advisors: #EchoLeakVulnerability #Microsoft365Copilot #AI-DrivenDataExfiltration
• Rescana: Executive Summary This report provides an in-depth examination of the recently identified vulnerability known as EchoLeak ...
• Blog: Critical vulnerability in Microsoft 365 Copilot
• beyondmachines.net: EchoLeak Vulnerability in Microsoft 365 Copilot Enables Silent AI-Driven Data Exfiltration
• www.bigdatawire.com: A critical security vulnerability in Microsoft Copilot that could have allowed attackers to easily access private data serves as a potent demonstration of the real security risks of generative AI. The post appeared first on .
• www.aiwire.net: A critical security vulnerability in Microsoft Copilot that could have allowed attackers to easily access private data serves as a potent demonstration of the real security risks of generative AI.
• BigDATAwire: Zero-Click Microsoft Copilot Vuln Underscores Emerging AI Security Risks
• AIwire: Zero-Click Microsoft Copilot Vuln Underscores Emerging AI Security Risks

Classification:

• HashTags: #AISecurity #ZeroClick #MicrosoftCopilot
• Company: AI Companies
• Target: Enterprises
• Product: Copilot
• Feature: Zero-Click Vulnerability
• Malware: EchoLeak
• Type: Vulnerability
• Severity: Medium