Living off Microsoft Copilot: Weaponising an AI Assistant
On this page
The attacker's best tool inside a company may be the AI assistant the company already trusts.
| When | August 2024 (Black Hat USA) |
|---|---|
| Target | Microsoft 365 Copilot / Copilot Studio |
| Vendor | Microsoft |
| Researcher | Michael Bargury (Zenity) |
| Technique | Injection + Copilot plugin/agency abuse (“living off the land”) |
| Tooling | LOLCopilot red-team tool released; works on default configs |
- 1Attacker plants hidden instructions in an email the victim never has to open
- 2Copilot ingests inbox/tenant content by default and is steered by the injection
- 3It surfaces secrets, spoofs a login page, or auto-sends spear-phishing on the victim's behalf
What happened
At Black Hat USA 2024, Zenity's Michael Bargury presented “Living off Microsoft Copilot,” showing how to abuse Microsoft 365 Copilot with no malware. Demonstrations included poisoning Copilot via an email the victim never opens (Copilot ingests inbox content by default), surfacing passwords and information shared in Teams, substituting attacker banking details, serving a fake Microsoft login/phishing page, and an automated spear-phishing capability that mimics a user's writing style. Zenity released LOLCopilot, a red-teaming tool that works against default Copilot configurations.
How the attack worked
Prompt injection plus abuse of Copilot's agency and plugins — the assistant's own trusted access to the tenant became the attacker's toolkit, no payload required.
No malware needed“Living off the land” means the attack rides the trusted, already-installed assistant — which is exactly why default configurations are the risk.
Root cause
A powerful, broadly-scoped assistant that ingests untrusted content by default and has authority to read data and take actions.
What a test would have caught
Adversarial red-teaming of the assistant's default configuration — can untrusted content make it exfiltrate, spoof, or send? — surfaces this whole class. Zenity's LOLCopilot exists to run exactly that test.
How to prevent it
- Limit what the assistant ingests unprompted, and scope its actions.
- Monitor and constrain Copilot's plugin/agent behaviour in your tenant.
- Test your own config with a tool like LOLCopilot before an attacker does.
Feel it yourselfThe replay lab lets you smuggle instructions through untrusted content and exfiltrate data out-of-band.
FAQ
Did this need malware?
No. The point of “living off the land” with Copilot is that the attacker uses the trusted, already-installed AI assistant itself — no payload to drop, working against default configurations.
What could the attacker achieve?
Demonstrations included surfacing passwords and Teams data, swapping in attacker bank details, serving a fake Microsoft login page, and auto-sending spear-phishing that mimics the victim's writing style.
What is LOLCopilot?
A red-teaming tool Zenity released to test these techniques against any Copilot-enabled M365 tenant — useful for defenders to check their own exposure.