CoPhish. The access path.
A Copilot Studio agent on a Microsoft domain collected OAuth tokens for the attacker. The token is real, the consent is real, and the egress does not appear in the victim traffic.
The record
Entry point. attacker tenant, a Copilot Studio agent whose sign-in topic was edited to add an HTTP action.
The identity in the middle. The victim's own delegated OAuth access token, legitimately minted after they consented to a multi-tenant Entra ID app, then captured in the agent's User.AccessToken variable.
What was reached. attacker endpoint, the token leaves in a custom header, sent from Microsoft infrastructure.
A Copilot Studio agent on a Microsoft domain collected OAuth tokens for the attacker.
The path, step by step.
Taken from the published reporting. Nothing here is reconstructed.
| Step | Role in the path | What the reporting records |
|---|---|---|
| attacker tenant | Entry | a Copilot Studio agent whose sign-in topic was edited to add an HTTP action |
| Entra ID app registration | Step | multi-tenant app with a secret and the Bot Framework reply URL |
| copilotstudio.microsoft.com link | Step | the victim sees a Microsoft hosted page and clicks Login |
| OAuth consent | Step | the token is minted by the victim's own account and lands in User.AccessToken |
| attacker endpoint | Reached | the token leaves in a custom header, sent from Microsoft infrastructure |
Where a breakpoint would have been
Who may consent, and to what. The lure is credible because the domain is genuine, so URL reputation buys nothing here. Restricting user consent for multi-tenant applications, and reviewing which roles can consent to any delegated permission, stops a valid token from ever being issued.
A breakpoint is the single change that closes a path with the least disruption. Read how that is chosen in the breakpoint page.
5 steps from entry to data.
Where this comes from.
Every field on this page is taken from the published reporting below. The breakpoint assessment is Elmoz reading that path, not a statement about what the affected organisation did.
Questions, answered.
The two questions this record answers.
What was the entry point in the CoPhish incident?
The published path starts at attacker tenant, a Copilot Studio agent whose sign-in topic was edited to add an HTTP action.
What did it reach?
The last step in the published path is attacker endpoint, the token leaves in a custom header, sent from Microsoft infrastructure.
Other incidents.
Same database, different path shape.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.