Full Report
A new phishing technique dubbed 'CoPhish' weaponizes Microsoft Copilot Studio agents to deliver fraudulent OAuth consent requests via legitimate and trusted Microsoft domains. [...]
Analysis Summary
# Main Topic
The introduction of 'CoPhish,' a novel phishing technique that weaponizes Microsoft Copilot Studio agents to distribute fraudulent OAuth consent requests through legitimate and trusted Microsoft domains, primarily aiming to steal user session tokens.
## Key Points
- CoPhish leverages the legitimate hosting environment of Copilot Studio agents on `copilotstudio.microsoft.com`.
- Attackers customize the "Login topic" within a Copilot agent to direct authenticated users to a malicious application flow.
- The technique facilitates the collection of session tokens by configuring an HTTP request within the agent to deliver the access token variable via a "token" header to an attacker-controlled URL (e.g., Burp Collaborator).
- The attack is effective because the resulting phishing page uses trusted Microsoft domains, increasing user trust.
- While targeting unprivileged users currently requires prior presence in the environment, external attackers can still target Application Administrators with externally registered apps, as existing fixes may not cover high-privileged roles.
- After successful authentication, the legitimate redirect to `token.botframework.com` masks the theft, as the session token transfer happens using Microsoft's IP addresses, evading typical user traffic monitoring.
## Threat Actors
- The technique was developed and disclosed by researchers at **Datadog Security Labs**.
- The identity of threat actors actively weaponizing this specific technique is not explicitly named, only the researchers who discovered it.
## TTPs
- **Agent Creation & Deployment:** Creating and customizing Copilot Studio agents, enabling the "demo website" feature for legitimate hosting.
- **OAuth Phishing:** Customizing the agent's "Login topic" to request application permissions via a fraudulent OAuth consent workflow.
- **Token Exfiltration:** Configuring the agent's sign-in settings using internal application IDs, secrets, and authentication provider URLs to redirect the collected access token via an HTTP request to a collaborator endpoint (e.g., Burp Collaborator).
- **Distribution:** Distributing the malicious agent link via email phishing campaigns or Microsoft Teams messages.
- **Social Engineering:** Relying on the legitimate appearance of the Microsoft-hosted page to trick users into clicking the "Login" button.
## Affected Systems
- **Platform:** Microsoft Copilot Studio agents (`copilotstudio.microsoft.com`).
- **Mechanism:** Microsoft OAuth consent framework leveraged via the agent's authentication flow.
- **Potential Targets:** Any user who interacts with a malicious agent link, particularly users with administrative privileges who can approve permissions for internal or external applications.
- **Validation Endpoint:** Legitimate Microsoft domain used in the final step: `token.botframework.com`.
## Mitigations
- **Administrative Controls:** Limit the scope of application permissions that users, especially administrators, can grant to applications.
- **Governance/Policy:** Enforce a strong application consent policy that covers gaps missed by Microsoft's baseline configuration.
- **Monitoring:** Closely monitor application consent events within Entra ID (Azure AD) and track Copilot Studio agent creation events.
- **User Awareness:** Be suspicious of the "Microsoft Power Platform" icon as a potential indicator of a less familiar service.
- **Microsoft Action:** Microsoft is planning product updates to address underlying causes (though these may not immediately cover high-privileged roles).
## Conclusion
CoPhish represents a significant evolution in cloud-based social engineering by abusing the trust associated with Microsoft's official Copilot Studio infrastructure. While Microsoft is working on fixes, organizations must immediately review and tighten application consent policies, especially concerning high-privileged roles, and enhance monitoring visibility over agent and application creation/configuration within their environments.