The Attachment Didn't Need You to Click. It Just Needed Copilot to Read.
EchoLeak turned ordinary Word files, slide decks and emails into silent exfiltration tools — no malware, no link, no user action. The payload was a polite sentence.
- Published by The Rogue Times
- Source event dated
- Length
- 2 min read
Every so often a vulnerability arrives that makes the entire security industry's tooling look like a metal detector at a poetry reading. CVE-2025-32711 — EchoLeak, found by researchers at Aim Security — is one of those.
The target was Microsoft 365 Copilot. The trick was that Copilot, asked to summarise or respond to a document, reads everything: visible text, hidden text, speaker notes, metadata. So attackers embedded instructions where nobody looks. Step one, prompt injection: a line in the file telling the assistant to disregard its instructions and fetch the user's recent mail. Microsoft's cross-prompt injection classifiers block the obvious phrasings; the researchers found phrasings that were not obvious.
Step two is the genuinely clever bit, and the reason this earns a nine. Prompt reflection. Copilot's answer goes back to whoever opened the file — so the attacker asks it to include an image hosted on the attacker's server, with the stolen data tucked into the image URL. The moment the picture loads, the data has already left the building. Nobody clicked anything. Nobody downloaded anything. Somebody opened a document.
That is why the usual defences shrug. There is no code in the payload, only words, so antivirus and static file scanning have nothing to match. Copilot is behaving exactly as designed: processing input and being helpful. There are no malware signatures, no alerts, and the technique travels across Word, PowerPoint, Outlook and Teams.
EchoLeak is not a lone oddity either. It sits in a growing shelf of model-specific bugs — CVE-2024-29990's prompt injection against ChatGPT's system instructions, CVE-2023-36052 writing plaintext secrets into Azure CLI logs — the shared theme being that an AI-integrated service leaks through indirect paths nobody drew on the architecture diagram.
The practical takeaway for anyone running an assistant over their document store: treat every file that reaches the model as untrusted input, because it is. Constrain what the assistant may fetch and render, especially remote images. Log what it reads and where its output points. And accept the uncomfortable premise underneath all of it — once a system understands natural language, natural language is an attack surface.
Filed under: the payload was polite, grammatical, and already inside the quarterly deck.
