AI Weekly Malaysia

Varonis Threat Labs disclosed three vulnerabilities in Microsoft Copilot Personal (the consumer assistant at copilot.microsoft.com), collectively named CoSnitch (CVE-2026-24301), that allowed a single click on a crafted link to silently exfiltrate data from connected apps. The attack hinges on an undocumented `autorun=1` URL parameter that Copilot itself revealed when researchers repeatedly asked it why a prompt couldn't execute without user interaction—an approach Varonis calls 'meta-hacking.' Patches shipped August 18, 2026; no evidence of in-the-wild exploitation, and Microsoft 365 Copilot is not stated to be affected.

Why: If you build AI agents or assistants that accept prompts via URL parameters, connect to external apps, or auto-execute on page load, this is a concrete blueprint for how that surface gets abused: an attacker-crafted URL can fire a prompt in the victim's authenticated session and run to completion even if they close the tab. Audit whether your own agent has any equivalent of an `autorun`-style parameter or a `q`-style pre-fill that, combined, could trigger unattended execution against connected data sources.

Varonis Threat Labs researchers manipulated Microsoft Copilot Personal into revealing its own attack surface by repeatedly asking it why auto-execution of prompts was impossible, a technique they call "meta-hacking." Copilot disclosed disabled URL parameters and a previously undocumented `autorun=1` parameter, enabling data exfiltration to an external server and persistent memory poisoning. Microsoft was notified in December 2025 and planned to patch and assign a CVE on the Tuesday following publication.

Why: If you build AI agents or ship LLM-powered assistants with persistent memory or URL-driven prompt injection, this writeup shows that conversational probing can surface your hidden guardrails and undocumented parameters. Audit your own assistant by asking it to explain its input handling and disabled features, and treat any persistent memory or auto-execution parameter as a data-exfiltration vector.

Ontinue's Cyber Defense Center disclosed TWINLOOT, a PyArmor-hardened Python implant that runs its entire C2 infrastructure inside trusted Microsoft services: SharePoint Online dead drops via Graph API for tasking, Teams TURN servers for interactive WebRTC access, and the victim's own headless Edge browser to ferry traffic so it looks legitimate. Initial access was via a Teams social engineering attack where someone impersonated IT support and convinced a target to run a PowerShell command downloading a 39 MB payload ('bootstrap-fat.pyc').

Why: If your organization uses Microsoft 365 and Teams, this shows a concrete attack chain where those trusted services become the C2 channel itself—SharePoint polling every 15 seconds, Teams TURN relays for reverse shells, and Edge browser traffic that blends into normal usage. The practical takeaway is to tighten Teams external messaging policies and train staff against IT-support impersonation, since that PowerShell one-liner was the entire foothold.

Thunderbird will move to a fortnightly release cadence starting September, matching Firefox's accelerated two-week schedule. Thunderbird 154 adds Microsoft Graph API support for Microsoft 365, which is timely because Exchange Web Services is being deprecated for Microsoft's cloud products. Firefox 154 adds GeForce NOW support, Mac profile backups, and an AI-powered 'Smart Window' feature.

Why: If you manage Thunderbird deployments connected to Microsoft 365, you should plan migration from EWS to the new Graph API support in version 154 before EWS stops working. IT teams who prefer stability should pin to version 153 ESR, which remains supported for the next year while the new two-week release cycle begins.

Microsoft MVP Loryan Strant created The Microsoft Rebrand Registry, a site listing 72 Microsoft products and the 158 names they've collectively held over the years. The site notes that Microsoft product names survive an average of 2 years and 11 months, identifies 8 products that have undergone three name changes (including Azure AI Search, Azure DevOps, and Microsoft Defender for Endpoint), and even predicts which products are likely to be renamed next based on naming frequency patterns.

Why: If your team builds on Azure or Microsoft 365, bookmark this site to resolve the constant confusion between old and new product names in docs, tickets, and conversations—especially since 8 products have already cycled through three names, meaning your existing documentation and infrastructure-as-code references are probably already stale.

Microsoft is retiring Excel's COPILOT() function on September 14, 2026, killing a feature that launched in preview only a year earlier and was never made generally available. The function let users invoke AI from a worksheet cell, but Microsoft now says the Copilot side pane covers the same capabilities. Google Sheets still offers a comparable AI function.

Why: If anyone in your team embedded COPILOT() in production spreadsheets, those formulas break on September 14 and need replacing with side-pane workflows or a migration to Google Sheets' equivalent AI function. This is also a cautionary tale for relying on preview-tier AI features in business-critical documents.

Kaspersky reports new modules in the Cavern C2 framework, used by Iranian-linked group Cavern Manticore against Israeli entities. The toolkit now uses DNS A-record responses to switch between direct HTTPS and a Google Apps Script relay, and a module called HOLLOWGRAPH abuses Microsoft 365 calendar events via the Graph API as a covert two-way C2 channel, dating events to 2050 to avoid detection.

Why: Unless you are building or defending SaaS APIs that could be abused as relay or dead-drop infrastructure (Google Apps Script, Microsoft Graph calendar), this has little direct impact on your work. The concrete takeaway for platform/security builders: legitimate cloud services like Google Apps Script and M365 Graph are increasingly used to hide malicious traffic, so rate-limiting and monitoring of script deployment IDs and calendar event anomalies may be worth reviewing.

The article URL points to an Ars Technica story about Microsoft Copilot revealing a secret input that allowed it to be hacked, but the fetched content contains only cookie consent and privacy boilerplate—no article body was retrieved.

Why: Cannot assess practical impact because the article text was not captured. If the story covers a prompt-injection or hidden-system-prompt vulnerability in Copilot, builders shipping AI agents should review it for lessons on input sanitization and system-prompt exposure—but that is speculation without the source text.

Microsoft is rolling out a theme setting for Outlook on the Web and New Outlook for Windows that makes them visually resemble Classic Outlook, with targeted release complete by end of September 2026 and general availability by end of October. The toggle only changes appearance—missing features like robust offline support, full .pst handling, and COM add-ins remain absent, and COM add-ins will never come to New Outlook. Classic Outlook support continues until at least 2029, with the opt-out phase pushed to 2027.

Why: If your team or customers rely on Outlook COM add-ins or full offline/.pst workflows, this cosmetic toggle changes nothing—plan migrations or alternative tooling now, since those capabilities will never arrive in New Outlook.

Microsoft Teams will keep its profanity filter enabled by default for GCC, GCC High, and DoD users until end of August, a one-month slip from the end-of-July target. The filter, which replaces profanity with asterisks in Live Captions, was supposed to be disabled by default earlier this year to better reflect spoken content and align with EU regulatory requirements.

Why: Minimal practical impact for this audience. This is a minor feature-delay notice affecting only US government Teams tenants; no action required unless you administer Teams in those environments.