CoPhish – New Phishing Technique Using CoPilot

10 December 2025by Cyber Shield Intelligence (CSI) Team

The first time analysts saw CoPhish in the wild, it did not look like a phishing attack at all. There were no fake login pages, no suspicious domains, no spelling mistakes, and no urgent warnings about account suspension. The links came from a trusted Microsoft domain and the interface looked exactly like any other Copilot experience.

This new technique uses Microsoft Copilot Studio to quietly steal OAuth tokens instead of passwords. Since everything is hosted on real Microsoft infrastructure, most users never question it. They believe they are interacting with a chatbot or previewing a Copilot feature. In reality, they are approving permissions for a malicious application that gives attackers direct access to mail, files, and other business data.

CoPhish is a reminder that identity attacks no longer rely on the old tricks. Attackers now aim for consent, not credentials.

Table of Contents

Technical Details

Why This Matters

How Wizard Cyber Can Help

Technical Details

Threat Overview

Security researchers from Datadog uncovered several malicious Copilot Studio agents that had been set up to look like internal tools. These agents were created inside attacker-controlled tenants and designed to guide victims through an OAuth device code flow. Once the user granted consent and entered the numeric code, the attacker could exchange that code for real access tokens.

Nothing in this process asks for a password. Everything looks legitimate. That is exactly why the technique works.

Technical Analysis:

How the CoPhish Attack Works

1. Building the Malicious Copilot Agent
  The attacker starts by creating a custom Copilot Studio agent inside their tenant. The agent contains a workflow that triggers the OAuth device code process. Its design imitates corporate assistants or internal support bots.
2. Delivering the Phishing Link
  The attacker then sends the victim a link to the agent. The link points to a real Microsoft domain such as copilotstudio.microsoft.com. Victims usually receive it through email or Teams, often framed as a Copilot demo or a productivity assistant.
  Because the domain is trusted, most users click without concern.
3. Victim Interacts with the Agent
  After opening the link, the victim sees a standard Copilot style interface. The bot appears to carry out a normal task and then requests the user to sign in to continue.
4. OAuth Consent and Device Code
  The agent leads the victim into a legitimate Microsoft OAuth consent flow. The user is asked to sign in and approve permissions such as:
  - offline_access
  - Mail.ReadWrite
  - Files.Read.All
  - Mail.Send
    These permissions give broad and long-lasting access to mailbox contents, files, and user data.
    After consenting, the victim receives a numeric device code.
5. Entering the Code
  The victim returns to the Copilot agent and enters the code. They believe this step verifies their identity. Instead, the code is exactly what the attacker needs.
6. Code Forwarded to Attacker Infrastructure
  The malicious agent immediately forwards the numeric code to an attacker controlled system.
7. Token Exchange
  The attacker submits the device code to the Microsoft token service and receives both access and refresh tokens. The scopes match whatever permissions the victim approved.
8. Persistent Access
  With these tokens, the attacker can read emails, access OneDrive files, collect Teams messages, and interact with other Microsoft 365 applications. Since the access is granted through user consent, it often goes unnoticed and does not trigger traditional credential based alerts.

MITRE ATT&CK Mapping

Tactic	Technique	ID
Initial Access	Phishing: Spearphishing Link	T1566.002
Credential Access	Steal Application Access Token	T1528
Defense Evasion	Abuse of Trusted Domains	T1078.004
Persistence	Valid Accounts (OAuth Token Persistence)	T1078

Prevention

The most effective protections focus on identity governance and app consent controls.

Restrict user consent to only approved applications
Use Admin Consent Workflow for any new or external app
Regularly audit OAuth permissions and remove unused apps
Train users to check the publisher, permission list, and purpose before approving any application

Detection

Below are the most effective, high-value detection queries for CoPhish-style attacks.

Microsoft Defender XDR:

OAuth Consent Triggered from Copilot Studio (High-Fidelity CoPhish Indicator)

CloudAppEvents
| where ActionType == "ConsentToApp"
| where URL contains "copilotstudio.microsoft.com"
| project Timestamp, UserPrincipalName, AppDisplayName, AppId, IPAddress, URL

High-Risk OAuth Permissions Often Exploited in CoPhish

CloudAppEvents
| where ActionType == "ConsentToApp"
| extend Perms = tostring(RawEventData.ResourcePermissions)
| where Perms has_any ("Mail.ReadWrite", "Files.Read.All", "offline_access", "Mail.Send")
| project Timestamp, UserPrincipalName, AppDisplayName, Perms, IPAddress

Microsoft Sentinel:

First-Time Consent to a Never-Seen-Before Application (Primary CTI Indicator)

let knownApps = AuditLogs
    | where OperationName == "Consent to application"
    | summarize by AppId;

AuditLogs
| where OperationName == "Consent to application"
| join kind=anti knownApps on AppId
| project TimeGenerated, AppDisplayName, AppId, InitiatedBy, TargetResources

OAuth Consent Spike (Multiple Users Targeted)

AuditLogs
| where OperationName == "Consent to application"
| summarize Count = count() by AppId, AppDisplayName, bin(TimeGenerated, 1h)
| where Count > 3
| order by Count desc

These queries give your detection teams the strongest possible visibility into CoPhish, without noise or generic patterns.

Remediation

If a malicious OAuth application is discovered:

Revoke access and refresh tokens immediately
Inspect and remove suspicious mailbox rules or forwarding actions
Require MFA reauthentication
Apply Conditional Access rules to prevent risky user consent in the future

Impacted Technologies

Microsoft Copilot Studio
Microsoft Entra ID
Exchange Online
OneDrive and SharePoint
Teams

Why This Matters

CoPhish represents a shift in phishing strategy: attackers now exploit trust in Microsoft-hosted systems rather than building fake login pages.
By abusing OAuth consent flows, attackers gain persistent access to business data without needing credentials.

This highlights the critical importance of:

Strong identity governance
Strict app consent policies
Continuous monitoring of OAuth activity
Educated, aware users

Strong identity governance

Strict app consent policies
Continuous monitoring of OAuth activity
Educated, aware users

If unmanaged, these attacks may lead to data exposure, privilege escalation, and long-term tenant compromise.

How Wizard Cyber Can Help

Wizard Cyber helps organizations defend against sophisticated consent-based phishing attacks like CoPhish by combining Microsoft’s native security capabilities with expert intelligence, monitoring, and response services. Our approach includes:

Continuous OAuth & App Monitoring – Using Defender XDR and Sentinel, we track consent events, unusual app authorizations, and anomalous OAuth token activity in real time.
Managed Detection & Response (MDR) – Rapid investigation and containment of suspected CoPhish incidents, including malicious token revocation and user re-authentication.
Identity Governance & App Exposure Management – Through Continuous Threat Exposure Management (CTEM), we identify and remediate high-risk applications, enforce app consent policies, and audit OAuth permissions across the tenant.
Proactive Threat Hunting – Focused hunts for consent anomalies, suspicious Copilot agent activity, and unauthorized OAuth flows.
Incident Response & Recovery – Guidance and execution of corrective actions, including removal of compromised applications, mailbox rule inspection, and application of conditional access controls.

By adopting a Zero Trust identity model and leveraging these services, organizations can reduce exposure to consent-based attacks, prevent unauthorized access to business data, and maintain robust identity and app security posture.

References

CYBERSECURITY READINESS

Strengthen Your Cyber Defences Today

As cyber threats grow more complex, proactive detection is no longer optional.

With Wizard Cyber’s Microsoft expertise, organizations can transform their security posture and gain real-time visibility across all endpoints.

Start your journey to smarter, faster cybersecurity today.

EXPLORE MORE

Related Blogs & Insights

Discover blogs that deepen your knowledge and accelerate your security strategy.

Trusted Services As Phishing Vectors: Techniques, Evasion, And Defensive Controls

Learn how attackers exploit trusted services for phishing and how Wizard Cyber detects and defends against these subtle threats.

How Attackers Used ICloud Calendar To Send Phishing Emails From Apple

Hackers abuse Apple’s iCloud Calendar invites to bypass defenses and steal Microsoft 365 credentials. Learn how Wizard Cyber stops these attacks.

Evading Detection: The Hidden Tricks Behind Today’s Phishing Attacks – Part1

Discover how attackers use obfuscation, JavaScript tricks, and click-fix tactics to bypass security and enhance phishing campaigns.

ABOUT THE AUTHOR

Mohammad A'mir

Incident Response & Threat Intelligence Analyst

Mohammad specialises in cyber threat intelligence, incident response, malware analysis, and threat actor profiling. He supports intelligence-led investigations by correlating threat intelligence with security incidents to improve detection and response. He holds Microsoft SC-200, AZ-500, and SC-300 certifications

Certifications: SC-200, AZ-500, SC-300

ABOUT THE AUTHOR

Farah Qamhawi

SOC Analyst Level 1

Farah specialises in security awareness, cyber security training, and user risk reduction. She develops and delivers programmes that help organisations strengthen their human layer of defence against cyber threats. She holds Microsoft SC-200, AZ-500, and SC-300 certifications

Certifications: SC-200, AZ-500, SC-300

Cyber Shield Intelligence (CSI) Team

Wizard Cyber’s first line of defense in proactive threat intelligence. CSI is dedicated to the identification, monitoring, and analysis of emerging cyber threats, including activity across the dark web, underground forums, and threat actor infrastructure. Leveraging advanced threat intelligence platforms, OSINT tools, and adversary tracking methodologies, the team provides actionable intelligence to anticipate attacks before they occur. With expertise in threat actor profiling, TTP mapping (aligned with the MITRE ATT&CK framework), and IOC enrichment, CSI equips clients with the critical insights needed to fortify defenses, mitigate risk, and stay ahead of evolving threat landscapes.

Trusted Services as Phishing Vectors: Techniques, Evasion, and Defensive Controls

Identifying Suspicious External Domains in Teams with Sentinel & Defender XDR

WIZARD CYBER