CoSnitch CVE-2026-24301: one Copilot link exfiltrated Gmail, Drive, Calendar, and memory with no detectable artifacts, patched after eight months, three Varonis Copilot disclosures this year      Ransom Busters: ransomware affiliate poses as recovery firm, contacts victims before attacks go public, demands $20-60K to delete stolen data, confirmed across DragonForce and Settra incidents      ShieldBreak CVE-2026-69414: Defender patch bypass reaches SYSTEM on fully-patched Windows, no patch available, public PoC from Nightmare Eclipse series      CoSnitch CVE-2026-24301: one Copilot link exfiltrated Gmail, Drive, Calendar, and memory with no detectable artifacts, patched after eight months, three Varonis Copilot disclosures this year      Ransom Busters: ransomware affiliate poses as recovery firm, contacts victims before attacks go public, demands $20-60K to delete stolen data, confirmed across DragonForce and Settra incidents      ShieldBreak CVE-2026-69414: Defender patch bypass reaches SYSTEM on fully-patched Windows, no patch available, public PoC from Nightmare Eclipse series     
CyberSipTM
Intelligence without the noise
Issue No. 113
August 20, 2026
3 items · past 24h
<5 min read
Today's picture

Varonis disclosed CoSnitch, CVE-2026-24301, a chain of three vulnerabilities in Microsoft Copilot Personal that a single malicious link could trigger to silently execute attacker-supplied prompts, pull data from connected OAuth applications including Gmail, Google Drive, Google Calendar, and Copilot's persistent memory, and transmit everything to an attacker-controlled server with no process, file, network, or log artifacts detectable by standard security tooling, with Microsoft patching the issue on August 18 nearly eight months after receiving the report. A ransomware affiliate calling itself Ransom Busters LTD is contacting ransomware victims before their attacks become public, claiming access to ransomware-as-a-service administrative panels, and offering to delete stolen data for $20,000 to $60,000, with GuidePoint Security confirming the group possessed the same stolen datasets as the attacking affiliate across DragonForce, Settra, and Anubis incidents. ShieldBreak CVE-2026-69414 is a new zero-day in Microsoft Defender that bypasses the earlier RoguePlanet patch and gives a local attacker with low privileges full SYSTEM access on Windows 10, Windows 11, and Windows Server including Server 2025, with no patch available and a public proof-of-concept from the same Nightmare Eclipse researcher who produced LegacyHive.

Today's intelligence
3 items
01 HighCopilot PersonalCoSnitch
CoSnitch: one malicious Copilot link silently exfiltrated Gmail, Drive, Calendar, and memory data with no detectable artifacts, patched eight months after report
CVE-2026-24301 chains three weaknesses: an undocumented autorun URL parameter that executes prompts instantly on page load, OAuth-scoped access to every connected account, and Copilot's URL-fetching capability to carry the exfiltrated data out. No click after the initial link. No process created. No network connection attributable to anything other than normal Copilot behavior. Patched August 18. No exploitation in the wild confirmed.
CVECVE-2026-24301
CVSS 8.8
NameCoSnitch
(Varonis)
PatchedAugust 18, 2026
(8 months post-report)
ScopeCopilot Personal only
copilot.microsoft.com
M365 Copilot
not affected
ExploitationNot confirmed
in wild
Varonis Threat Labs disclosed CoSnitch on August 18, 2026, the same day Microsoft shipped the fix. Researcher Lior Adar reported the vulnerability chain to Microsoft in December 2025. The disclosure came nearly eight months later. CoSnitch chains three separate weaknesses in Microsoft Copilot Personal, the consumer AI assistant hosted at copilot.microsoft.com. The first weakness is automatic prompt execution: the standard ?q= URL parameter for pre-populating a Copilot query can be combined with a second, undocumented parameter, which Varonis identifies as ?autorun=1 in its technical write-up, to cause Copilot to execute the embedded prompt instantly when the page loads rather than waiting for the user to press Enter. An attacker sends a victim a link that looks like a normal Copilot URL. When the victim clicks the link and Copilot loads, the attacker's prompt fires automatically in the context of the victim's authenticated session. The second weakness is OAuth-scoped data access: Copilot Personal can be connected to Gmail, Google Drive, Google Calendar, and other services through OAuth integrations. A prompt running in the victim's authenticated session can read data from any of those connected sources as if the user had asked Copilot to retrieve it. The third weakness is the exfiltration path: Copilot has a capability to fetch and summarize external URLs. An attacker-controlled prompt can gather data from connected accounts into the model's active context, encode it for URL transport, and instruct Copilot to request an attacker-controlled URL containing the encoded information. The response, including email content, calendar entries, file metadata, chat history, and persistent memory contents, arrives at the attacker's server through what appears to be a routine Copilot summarization request. Varonis confirmed that the entire attack chain produces no process, file, network connection, or log entry that standard security tooling would flag as anomalous. The exfiltration is indistinguishable from normal Copilot behavior. Microsoft assigned CVSS 8.8, rated it a critical information disclosure vulnerability, and noted no customer action is required following the August 18 patch. Enterprise customers using Microsoft 365 Copilot are unaffected. The scope is limited to Copilot Personal. Varonis confirmed no evidence of exploitation in the wild before the patch.
CoSnitch is the third Copilot vulnerability Varonis disclosed this year, following Reprompt, which bypassed safety guardrails by repeating a question, and SearchLeak, which turned Microsoft 365 Copilot Enterprise into a silent exfiltration channel. All three share the same attack pattern: one click on a link that looks ordinary triggers a chain the victim cannot observe, producing data exfiltration that looks like normal assistant activity. The operational concern for enterprise security teams is not only that Copilot Personal was exploitable. It is that the pattern Varonis identified, automatic prompt execution through a crafted URL followed by OAuth-scoped data access and exfiltration through a routine assistant capability, is not unique to Copilot. Any AI assistant that accepts prompts through URL parameters, has broad OAuth access to connected services, and can reach external URLs as part of its normal function has the same structural attack surface. The meta-hacking discovery method Varonis used, repeatedly asking Copilot why automatic prompt execution was supposedly impossible until it surfaced the mechanism, is additionally significant: the researchers did not reverse-engineer code to find the flaw. They asked the AI to reveal it.
The eight-month timeline between Varonis's report in December 2025 and the patch in August 2026 is worth noting against the backdrop of this brief's other AI prompt injection tracking. Researcher Håkon Maloy reported a separate M365 Copilot memory poisoning issue in March 2026 with a mitigated-globally status as of June 22, 2026. Johann Rehberger reported memory writes and deletions through indirect prompt injection in Microsoft 365 Copilot separately. M365 Copilot's unauthenticated prompt injection path, tracked in Issue 98 as unpatched at the time, has now exceeded 160 days without a formal CVE or a complete patch confirmation. CoSnitch's consumer scope and eight-month patch timeline reflect the same dynamic visible in enterprise Copilot: the AI assistant attack surface is being disclosed faster than it is being closed. Copilot Personal users with Gmail, Google Drive, or Google Calendar connected through OAuth should review and audit those connections, remove integrations that are not actively used, and treat the Copilot memory feature as a potential persistence mechanism that warrants periodic review of its stored contents.
  • Review and audit all OAuth integrations connected to Copilot Personal for any user whose account may have received a suspicious or unexpected Copilot link. Navigate to the Copilot Personal settings and review connected apps. Disconnect any integration that is not actively required. Gmail, Google Drive, and Google Calendar connections are the specific OAuth scopes documented in the CoSnitch exfiltration path.
  • Review the contents of Copilot Personal's persistent memory feature for any unexpected or attacker-introduced entries. CoSnitch demonstrated the ability to perform memory poisoning as part of the attack chain. Memories stored in Copilot influence future responses and can persist across sessions. Access Copilot memory settings and review all stored items, removing any that are unfamiliar or unexpectedly specific about sensitive topics.
  • For enterprise security teams, assess whether monitoring tools can detect anomalous data access originating from AI assistant sessions. The Varonis disclosure confirms that CoSnitch's exfiltration produces no log artifacts distinguishable from normal Copilot behavior. If monitoring coverage does not include the AI assistant access layer, the same detection gap applies to any future prompt injection attack through similar assistants.
One link. Copilot fires an attacker prompt automatically. The prompt reads Gmail, Drive, Calendar, and memory. The data leaves through what looks like a normal Copilot URL fetch. No alert fires. The assistant did exactly what it was designed to do. The patch shipped eight months after the report. Review the OAuth connections and clear the memory.
02 HighRansom BustersRe-Extortion
Ransom Busters is a ransomware affiliate posing as a recovery firm that contacts victims before attacks go public and demands up to $60,000 to delete stolen data
The group knows about incidents before they are disclosed. GuidePoint confirmed it possessed the same stolen datasets as the actual attackers. It claims access to RaaS administrative panels. It offers to decrypt files and delete stolen data, then demands payment. None of that is recovery. It is a second extortion demand layered on top of the first, from an actor who may also be the original attacker.
ActorRansom Busters LTD
(suspected RaaS affiliate)
MethodUnsolicited email to
CEO or IT leader
before public disclosure
Demand$20,000–$60,000
to delete stolen data
Linked toDragonForce
Settra
Anubis incidents
GuidePoint Security's Research and Intelligence Team published analysis on August 18 of a threat actor operating as Ransom Busters LTD. The group targets organizations that have suffered ransomware attacks by sending unsolicited emails to CEOs or IT leaders before the attacks become public. The emails claim that Ransom Busters has discovered the victim's stolen data on ransomware servers, has accessed the encryption key storage of the attacking ransomware group, and can delete the exfiltrated data while also providing decryption keys, offering the service for $20,000 to $60,000. GuidePoint observed this activity during incident response engagements for attacks linked to DragonForce, Settra, and Anubis ransomware operations. During engagement with the actor, GuidePoint confirmed that Ransom Busters possessed the same stolen datasets held by the ransomware affiliate responsible for each intrusion. The group claims to have exploited vulnerabilities in the administrative panels of ransomware-as-a-service operations, giving it access to victim data, encryption keys, and infrastructure controls. GRIT assesses with moderate confidence that Ransom Busters is actually a ransomware affiliate, likely operating across multiple RaaS operations, attempting to divert extortion payments from the primary ransomware group by offering a parallel payment path. The group also overlaps in tooling with broader campaigns, using SoftPerfect Network Scanner and s5cmd, tools consistent with ransomware affiliate tradecraft. The pre-disclosure contact is the most operationally concerning detail: it implies either insider access to ransomware group communications, active participation in the initial attack, or direct access to the RaaS panel that the group claims to have compromised. GuidePoint notes that any unauthorized access to a ransomware group's servers, even with the stated intent of helping victims, may constitute a violation of the Computer Fraud and Abuse Act.
Ransom Busters represents a new complexity layer in the incident response environment following a ransomware attack. Victims already face a core extortion decision from the primary ransomware group. They now face a second unsolicited contact from an actor who claims to be on their side but whose knowledge of the non-public incident can only be explained by direct involvement, insider access, or RaaS panel compromise. A victim who engages with Ransom Busters under the belief that it is a legitimate recovery service may pay $20,000 to $60,000 for no actual data deletion, no authentic decryption keys, and no reduction in the primary attacker's leverage. The payment also funds an actor whose relationship to the original attack is unclear and who may retain copies of the stolen data regardless of any deletion claim. The pre-disclosure contact timing is the clearest indicator that something is wrong: legitimate incident response firms offer services after disclosures, not before, because they learn about incidents through the same channels everyone else does.
The Ransom Busters pattern builds on a trend GuidePoint and other IR firms have documented since 2024: secondary extortion contacts targeting ransomware victims from actors who claim third-party access to stolen data. The prior form of this was threat actors purchasing stolen data from ransomware groups and then extorting victims independently. Ransom Busters represents a more sophisticated variant where the actor frames itself as a helper rather than an additional extortionist. The practical test for any organization that receives an unsolicited email claiming knowledge of a non-public security incident is whether the sender could plausibly have learned about the incident through legitimate means. If the answer is no, and if the contact arrives before any public disclosure, the communication should be treated as a red flag and reported to the incident response team and legal counsel before any engagement occurs. Engaging with Ransom Busters or similar actors without legal guidance risks CFAA exposure for the victim organization in addition to the financial risk of payment.
  • If your organization receives an unsolicited email from a party claiming knowledge of a non-public security incident and offering data recovery or deletion services, do not engage directly. Route the communication immediately to your incident response team, legal counsel, and the FBI's Internet Crime Complaint Center at ic3.gov. Pre-disclosure knowledge of a private incident is a significant indicator of direct involvement or compromised access to the attacker's infrastructure.
  • Verify the legitimacy of any incident recovery firm through independent channels before engaging their services. Legitimate IR firms are verifiable through prior case references, published research, and established industry presence. An unsolicited contact from an unfamiliar entity offering to delete stolen data is not a starting point for a legitimate IR engagement.
  • Review your incident response plan for procedures covering secondary extortion contacts and pre-disclosure outreach from unknown parties. The Ransom Busters pattern suggests that organizations should have a documented process for handling these contacts that routes them to legal and IR teams before any decision is made about engagement or payment.
They knew about the incident before it was public. They have the same stolen data as the attacker. They are offering to help for $20,000 to $60,000. That is not recovery. It is a second extortion demand from someone who was probably in the room for the first one. Do not engage. Route it to legal and the FBI.
03 HighMicrosoft DefenderShieldBreak
ShieldBreak bypasses the Defender patch for RoguePlanet and reaches SYSTEM on fully patched Windows with no patch available
CVE-2026-69414 is a patch bypass from the same Nightmare Eclipse researcher series that produced LegacyHive, which sat without a patch for 24 days. It affects Windows 10, Windows 11, and Windows Server including Server 2025. A local attacker with low privileges runs a public proof-of-concept and reaches NT AUTHORITY\SYSTEM. No patch yet. Microsoft is investigating.
CVECVE-2026-69414
ShieldBreak
BypassesRoguePlanet fix
CVE-2026-50656
ResearcherNightmare Eclipse
(Nightmare Eclipse
series)
AffectedWindows 10, 11
Server incl. 2025
PatchNot available
Microsoft investigating
Four days after Microsoft's August 2026 Patch Tuesday, the researcher known as Nightmare Eclipse published ShieldBreak, a new zero-day in Microsoft Defender tracked as CVE-2026-69414. ShieldBreak is a patch bypass for RoguePlanet, CVE-2026-50656, a Microsoft Defender privilege-escalation vulnerability that Microsoft patched in a prior release with a CVSS score of 7.8. A patch bypass means that Microsoft's original fix for RoguePlanet did not fully close the underlying vulnerability, and Nightmare Eclipse found a variant of the same attack path that the patch did not address. ShieldBreak lets a local attacker with low privileges escalate to NT AUTHORITY\SYSTEM, the highest level of access on a Windows system, on Windows 10, Windows 11, and Windows Server including the current Server 2025 release. A public proof-of-concept is available. Technical write-ups at the time of disclosure described a 100% success rate against fully patched test systems, with later reporting noting variability between machines on specific configurations. No exploitation in the wild has been confirmed. Microsoft is investigating and has not yet published a patch or a scheduled patch date. Nightmare Eclipse is the same researcher responsible for the LegacyHive series covered in this brief from Issue 88 through Issue 106. CVE-2026-62832, the User Profile Service elevation-of-privilege flaw from that series, sat for 24 days without a patch before Microsoft closed it in August Patch Tuesday. Three prior disclosures in the same series were exploited before their patches arrived.
ShieldBreak is a privilege escalation flaw, meaning it requires an attacker who already has low-privileged code execution on a Windows system. It does not provide initial access. What it provides is reliable escalation from any low-privileged foothold to full SYSTEM access on fully patched Windows systems. That makes it a consistent second-stage tool for any threat actor who has achieved code execution through phishing, a browser exploit, a remote vulnerability, or any other initial access method. The Microsoft Defender context is relevant: Defender is the security monitoring component that ShieldBreak bypasses as part of the escalation path, which has the same operational implication as FudModule in Issue 106: a privilege escalation that specifically targets or bypasses the security monitoring layer compounds the impact beyond simple privilege gain. The prior Nightmare Eclipse disclosure pattern is the operational signal: three prior series disclosures were exploited before patches arrived. A fourth, LegacyHive, held for 24 days. Treating ShieldBreak as lower priority because it lacks a CISA KEV entry would be consistent with a pattern that has previously resulted in exploitation before remediation.
Patch bypasses are operationally significant beyond their direct impact because they reveal that the original vulnerability was not fully understood when patched. RoguePlanet received a fix. ShieldBreak demonstrates the fix was incomplete. The same pattern appeared with ProxyNotShell and the subsequent ProxyShell bypass, and with CitrixBleed and its predecessor. A partially closed vulnerability that a determined researcher can reopen through a variant of the original attack may be reopened again after ShieldBreak's patch as well. Organizations that have been applying Nightmare Eclipse series patches as they arrive should continue doing so, with the understanding that each patch in this series has been followed by a subsequent bypass. The practical implication for detection is to prioritize monitoring for the privilege escalation indicators specific to the ShieldBreak proof-of-concept while waiting for the patch, rather than relying on existing detections for RoguePlanet that will not trigger for the bypass variant.
  • Monitor Microsoft's Security Response Center for a patch or interim mitigation for CVE-2026-69414. Given the Nightmare Eclipse series history, apply any patch immediately upon release rather than waiting for the next scheduled Patch Tuesday. Check the MSRC advisory page for ShieldBreak specifically for any workaround guidance Microsoft may publish before a patch is ready.
  • Prioritize detection coverage for the ShieldBreak privilege escalation path. The public proof-of-concept gives security tooling vendors and detection engineers the specific technique to build signatures for. If your endpoint detection platform has not yet updated detections for CVE-2026-69414, request an update and verify coverage before relying on existing detections for the prior RoguePlanet flaw.
  • Apply defense-in-depth controls that reduce the value of SYSTEM access even when it is achieved: privileged access workstations for administrative tasks, tiered administrator account models, network segmentation that limits what a SYSTEM-level process can reach, and application allowlisting that restricts what can execute in elevated contexts. These controls limit the operational impact of a successful ShieldBreak escalation while a patch is unavailable.
The RoguePlanet patch did not fully close the door. ShieldBreak walks through the gap. Low privileges in, SYSTEM out, fully patched Windows. No patch yet. The Nightmare Eclipse series had three prior exploited-before-patch disclosures. Monitor MSRC and apply the fix the day it ships.
Cross-source standouts
01
CoSnitch, SearchLeak, Reprompt: three Varonis Copilot disclosures this year sharing the same one-click exfiltration pattern
Varonis has now disclosed three separate vulnerabilities in Microsoft Copilot products this year, and all three share the same structural attack pattern: a single click on a link that looks ordinary triggers a chain the victim cannot observe, producing data exfiltration that looks like normal assistant activity. Reprompt bypassed Copilot's safety guardrails by repeating a question. SearchLeak turned Microsoft 365 Copilot Enterprise into an exfiltration channel. CoSnitch exploited three chained weaknesses in Copilot Personal to exfiltrate OAuth-connected account data with no detectable artifacts. The common thread is not that Microsoft's Copilot products are uniquely vulnerable. It is that AI assistants with broad data access and the ability to reach external URLs represent a class of system that has not been fully incorporated into enterprise security models. An employee's inbox, calendar, cloud storage, and chat history are now accessible through their AI assistant session. An attacker who can influence what the assistant does, whether through a crafted URL, an injected document, or a memory poisoning attack, has access to everything the assistant can reach. The monitoring and detection frameworks built for traditional data access events, login events, file access events, DLP triggers, do not capture AI-mediated data access because the assistant is behaving normally. CoSnitch was undetectable by standard tooling not because of a specific evasion technique but because Copilot doing exactly what it was designed to do is indistinguishable from Copilot doing what an attacker told it to do.
02
Ransom Busters and the trust problem after a ransomware attack: who is actually on your side
A ransomware attack creates an acute trust problem for the victim organization. The victim is under time pressure, facing operational disruption, uncertain about the scope of data theft, and being contacted by the primary attacker with a payment demand. In that environment, an unsolicited email from a party that knows about the incident and offers to help can appear valuable. Ransom Busters exploits exactly that vulnerability. The structural tell in the Ransom Busters approach is the pre-disclosure contact timing. Legitimate incident response firms learn about incidents through the same channels everyone else does: public disclosures, threat feeds, victim outreach, or established relationships. A firm that knows about a private, non-disclosed incident before anyone else can know about it legitimately is either directly involved in the attack, has access to the attacker's communications, or has compromised the RaaS infrastructure as claimed. The third option, compromised RaaS infrastructure, is the one Ransom Busters claims. Even if true, it does not make the offer legitimate: unauthorized access to criminal servers to delete victim data is still unauthorized access, and payment to a party that conducted unauthorized access carries its own legal complexity. The simpler explanation, that the actor is a ransomware affiliate using insider knowledge to run a second extortion scheme, is what GuidePoint assessed as the most likely explanation, and it is the framing that organizations should apply to any contact that arrives with non-public incident knowledge before they have a chance to evaluate the source.
Still watching
Days 2–5
Ray CVE-2025-62593 (Issue 111 · CISA KEV, federal deadline was today August 20) — federal deadline passed today. Upgrade to Ray 2.52.0. Restrict ports 8265 and 8000 to trusted networks. For clusters accessible before today, audit job history and rotate AI provider keys, cloud credentials, and any tokens accessible to the cluster environment.
Day 3
Zoom CVE-2026-53413 Zoomsday (Issue 110 · zero-click RCE, patched August 11) — update to Workplace 7.1.5 or 7.0.6. Confirm the version in Help, About Zoom. Enterprise managed deployments with delayed cycles may not have the patch applied. E2EE meetings are not covered by server-side filtering.
Day 7+
GeoServer zero-day (no CVE, no patch) (Issue 108 · active probing, jsonArrayContains SQL injection) — no patch available as of August 20. Restrict public access to WFS endpoints. Limit SQL Server database account permissions to block xp_cmdshell. Monitor jsonArrayContains filter logs since August 12.
Day 7+
GitLab CVE-2026-19478 (Issue 111 · CVSS 9.4, no patch for 18.2–18.10 branches) — upgrade to 19.2.4, 19.1.6, 19.0.8, or 18.11.11. Instances on 18.2 through 18.10 have no patch available. Restrict the /api/graphql endpoint at the network or reverse proxy level as an interim control if upgrade is not yet possible.
Day 3