{
 "type": "bundle",
 "id": "bundle--bfa8e6e1-bf74-5ef5-b778-de1137e4e605",
 "objects": [
  {
   "type": "incident",
   "spec_version": "2.1",
   "id": "incident--35a02815-c120-5435-8d50-00b5e9a0cc85",
   "created": "2025-06-11T00:00:00.000Z",
   "modified": "2025-06-11T00:00:00.000Z",
   "name": "EchoLeak: a zero-click email exfiltrates Microsoft 365 Copilot's context",
   "description": "A crafted email the user never opens is retrieved by Microsoft 365 Copilot's RAG and instructs it to embed sensitive context in an image URL fetched through an allowed Microsoft domain, bypassing the content-security policy. No user interaction. Microsoft fixed it server-side (CVE-2025-32711, CVSS 9.3).",
   "external_references": [
    {
     "source_name": "AgentDossier",
     "external_id": "TR-2026-002",
     "url": "https://sushegaad.github.io/AgentDossier/traces/tr-2026-002/"
    },
    {
     "source_name": "Dark Reading",
     "url": "https://darkreading.com/application-security/researchers-detail-zero-click-copilot-exploit-echoleak",
     "description": "Researchers Detail Zero-Click Copilot Exploit 'EchoLeak'"
    }
   ]
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--e21aad0d-3e5a-597d-8272-0dd55eb219a5",
   "created": "2025-06-11T00:00:00.000Z",
   "modified": "2025-06-11T00:00:00.000Z",
   "name": "Security researchers (Aim Security / Aim Labs), proof of concept",
   "roles": [
    "attacker"
   ]
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--befaf5a5-927a-5155-860a-2d054a7ad9e5",
   "created": "2025-06-11T00:00:00.000Z",
   "modified": "2025-06-11T00:00:00.000Z",
   "name": "Microsoft — fixed server-side before publication",
   "roles": [
    "defender"
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--d81e9799-d83a-5fad-a836-67711802af35",
   "created": "2025-06-11T00:00:00.000Z",
   "modified": "2025-06-11T00:00:00.000Z",
   "name": "TA0001 Initial Access",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0001"
    }
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--240613a1-cc4a-539d-845e-d3997c6243d5",
   "created": "2025-06-11T00:00:00.000Z",
   "modified": "2025-06-11T00:00:00.000Z",
   "name": "TA0005 Defense Evasion",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0005"
    }
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--407e5f09-906a-57ed-9096-af01f012f7b5",
   "created": "2025-06-11T00:00:00.000Z",
   "modified": "2025-06-11T00:00:00.000Z",
   "name": "TA0009 Collection",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0009"
    }
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--62eee9bd-5e4e-5de5-8aae-e14d66eef545",
   "created": "2025-06-11T00:00:00.000Z",
   "modified": "2025-06-11T00:00:00.000Z",
   "name": "TA0010 Exfiltration",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0010"
    }
   ]
  }
 ]
}