A new phishing technique called CoPhish has emerged, leveraging Microsoft Copilot to enhance OAuth phishing attacks. This innovative method tricks users into granting malicious apps access to their Microsoft accounts by mimicking legitimate Microsoft Copilot prompts. The attack exploits the trust users place in Microsoft’s AI assistant, increasing the likelihood of successful credential theft and unauthorized access. Cybersecurity experts warn that this technique represents a significant evolution in phishing tactics, combining social engineering with advanced AI-driven interfaces to deceive victims more effectively. Organizations and individuals are urged to remain vigilant, implement multi-factor authentication, and educate users about the risks of OAuth phishing and the importance of scrutinizing permission requests, even when they appear to come from trusted sources like Microsoft Copilot. This development underscores the need for continuous adaptation in cybersecurity defenses to counter increasingly sophisticated social engineering attacks.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Sat, 25 Oct 2025 16:20:56 +0000