This Word Document Steals Your Password From Microsoft Copilot (+ LIVE DEMO)

Attack Overview

Johan demonstrates stealing passwords from Microsoft Copilot using only a Word document—no link clicks, macros, or downloads. Victims trigger the attack by pressing the built-in summarize button.

Persistent Memory Exfiltration

The chain combines prompt injection, a CSP bypass, and storage in Copilot's per-user memory. Once planted via a malicious document or email, the payload persists across future conversations in Word, Excel, Outlook, and SharePoint, activating on trigger words or actions.

Novel Exfiltration Channel

Unlike typical AI attacks using image blocks, Microsoft blocks images here. Data instead exits through a font-based channel—an unexpected vector the researcher had not seen before. Johan notes he even asked Copilot to help find the CSP bypass.

Broader Context

The interview ties to prior DEF CON Singapore research on persistent Copilot data exfiltration and discusses how memory features in AI assistants create durable attack surfaces once compromise occurs.