CoPhish Breach: OAuth Token Theft via Copilot Studio Agents

Executive Summary

In March 2025, a significant data breach was reported involving the exploitation of OAuth tokens via malicious agents in Copilot Studio. Attackers utilized the platform’s demo functionality to create fraudulent agents that impersonated legitimate services, hosted on trusted Microsoft domains. This phishing attack leveraged OAuth consent flows, tricking users into granting access and compromising sensitive authentication tokens. The scale of impact is substantial as countless users of the Copilot Studio platform fell victim to this sophisticated attack, leading to potential unauthorized access to user accounts and sensitive data. Cybersecurity experts have raised alarms over this new phishing technique, emphasizing the urgent need for improved protective measures.

 Read the full breach analysis from NHI Mgmt Group here

Key Details

Breach Timeline

• March 2025: Attackers launched the CoPhish attack exploiting Copilot Studio.
• October 2025: Datadog Security Labs disclosed the phishing technique and its implications.
• Future updates from Microsoft are expected to address the vulnerabilities.

Data Compromised

• OAuth tokens were stolen, granting unauthorized access to user accounts.
• Potential access to sensitive information, including personal and corporate data.

Impact Assessment

• Widespread phishing resulted in numerous users unknowingly compromising their credentials.
• Organizations using Copilot Studio are at risk of data breaches and identity theft.

Company Response

• Microsoft has acknowledged the issue and is actively working on a fix for the security gaps.
• Users are being advised to monitor their accounts for suspicious activities.

Security Implications

• This incident highlights the vulnerabilities of OAuth-based identity systems.
• Organizations must enhance their cybersecurity protocols to prevent similar attacks.

 If you want to learn more about how to secure NHIs including AI Agents, check our NHI Foundational Training Course.