Microsoft 365 Copilot Financial Transaction Hijacking via RAG

# Microsoft 365 Copilot Financial Transaction Hijacking via RAG

https://gcdradar.vercel.app/incidents/microsoft-365-copilot-financial-transaction-hijacking-via-ra · AIR-2025-0051 · closed 2025-03-28

- Lane: Research
- Severity: 1 (Research / proof of concept)
- Fix status: Fix status unknown
- First reported: 2025-03-14 (happened 2024-08-08)
- AI role: Attack on AI
- Products: Microsoft 365 Copilot

## Summary

Researchers demonstrated that an attacker can manipulate Microsoft 365 Copilot into redirecting wire transfers using indirect prompt injection via ingested emails. The red-team exercise proved how RAG systems can be abused to alter downstream enterprise actions.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2025-03-14: Living off Microsoft Copilot at BHUSA24: Financial transaction hijacking with Copilot as an insider, YouTube (https://youtu.be/Z9jvzFxhayA?si=FJmzxTMDui2qO1Zj)
- 2025-03-14: We got an ~RCE on M365 Copilot by sending an email., Twitter (https://twitter.com/mbrg0/status/1821551825369415875)
- 2025-03-14: Article from The Register with response from Microsoft (https://theregister.com/2024/08/08/copilot_black_hat_vulns)
- 2025-03-14: Financial Transaction Hijacking with M365 Copilot as an Insider (https://atlas.mitre.org/studies/AML.CS0026)

## Sources

- 2025-03-14 MITRE ATLAS: Financial Transaction Hijacking with M365 Copilot as an Insider https://atlas.mitre.org/studies/AML.CS0026
- 2025-03-14 The Register: Article from The Register with response from Microsoft https://theregister.com/2024/08/08/copilot_black_hat_vulns
- 2025-03-14 twitter.com: We got an ~RCE on M365 Copilot by sending an email., Twitter https://twitter.com/mbrg0/status/1821551825369415875
- 2025-03-14 youtu.be: Living off Microsoft Copilot at BHUSA24: Financial transaction hijacking with Copilot as an insider, YouTube https://youtu.be/Z9jvzFxhayA?si=FJmzxTMDui2qO1Zj

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.