Microsoft Copilot Aids Wire Fraud Chains in Shocking Proof-of-Concept

Barracuda researchers have demonstrated how Microsoft's Copilot AI assistant can be used to speed up wire fraud chains. In their proof-of-concept, they showed that an attacker with a standard employee's Microsoft 365 login could use Copilot to hide login alerts, read recent conversations, and map the company structure.

The researchers created an inbox rule using Copilot to send sign-in notifications to the Deleted Items folder, keeping the compromised employee from seeing warning signs. They also used Copilot to summarize active threads, identify key personnel, and draft convincing messages.

Once inside the CEO's mailbox, the attackers used Copilot to find recent financial emails, including invoices and dollar amounts. The AI assistant helped them draft a message in the CEO's style, asking for a change to receiving bank details on a pending $247,500 wire transfer. This kind of attack moves quickly because it leverages an ordinary employee's Microsoft 365 account, a convincing message, and Copilot's ability to search the inbox faster than any human attacker.