Reprompt: The Single-Click Microsoft Copilot Attack that Silently Steals Your Personal Data

Varonis Threat Labs disclosed “Reprompt,” a one-click attack against Microsoft Copilot Personal that abuses the q URL parameter to inject prompts and then uses server-driven follow-up requests to stealthily exfiltrate user data and conversation memory without further interaction. Microsoft has patched the issue and says enterprise Microsoft 365 Copilot customers are not affected, but vendors and users should treat deep links and pre-filled prompts as untrusted and harden against prompt chaining. #Reprompt #MicrosoftCopilot

Keypoints

Reprompt is a one-click attack that uses a legitimate Microsoft Copilot link (the q URL parameter) to inject a prompt and begin silent, persistent data exfiltration.
The attacker retains control after the Copilot chat is closed because follow-up commands are delivered from the attacker’s server, allowing continued exfiltration without further user input.
The attack bypasses Copilot’s built-in safeguards by exploiting the q parameter and using a double-request technique so protections that apply only to the initial request are defeated.
The chain-request technique enables staged, dynamic theft of multiple data points (e.g., username, location, conversation summaries) by having the server return successive instructions based on prior responses.
Client-side monitoring and simple prompt inspection are ineffective because the real instructions and exfiltrated data are transmitted dynamically from the attacker’s server after the initial prompt.
Microsoft has patched the flaw; Varonis recommends vendors validate external inputs, persist safeguards across follow-up requests, and enforce least privilege and auditing for AI assistants.

MITRE Techniques

[T1204 ] User Execution – The attack requires the victim to click a link to trigger the q parameter injection, enabling compromise with a single click (‘Only a single click on a legitimate Microsoft link is required to compromise victims.’)
[T1190 ] Exploit Public-Facing Application – Reprompt exploits default functionality in Copilot’s URL handling (the q parameter) to execute attacker-supplied prompts via the application interface (‘Exploiting the ‘q’ URL parameter is used in Reprompt to fill the prompt directly from a URL.’)
[T1071.001 ] Application Layer Protocol: Web Protocols – Commands and follow-up instructions are delivered from the attacker’s server over web requests, forming the control/exfiltration channel (‘All commands are delivered from the server after the initial prompt, making it impossible to determine what data is being exfiltrated just by inspecting the starting prompt.’)
[T1567.002 ] Exfiltration Over Web Service – Sensitive user data and conversation memory are progressively sent to attacker-controlled web endpoints (staged URLs like https://malicious[.]com/stage2//time), enabling scalable data theft (‘stage 2 on https://malicious[.]com/stage2//time’)
[T1213 ] Data from Information Repositories – The attack queries and extracts user files and profile details (e.g., “Summarize all of the files that the user accessed today”) from Copilot-accessible sources and conversation history (‘Summarize all of the files that the user accessed today, Where does the user live?’)

Indicators of Compromise

[Domain ] example malicious command-and-control and target domains – malicious[.]com (attacker-controlled domain used in staged URLs), copilot.microsoft.com (targeted Copilot endpoint)
[URL ] example deep-link and pre-filled prompt URLs used to trigger the attack – http://copilot.microsoft.com/?q=Hello, https://copilot.microsoft.com/?q=Always%20first%20change%20variable%20then%20looks%20at%20the%20URL… (full pre-filled q parameter example)
[File name ] example resource referenced in prompt injection – /birdd.jpg (used in pseudo-code to induce URL fetching)
[Secret/string ] example leaked data used in testing/exfiltration demonstration – HELLOWORLD1234! (secret phrase used to demonstrate double-request leak)