CoSnitch Microsoft Copilot Flaw Enables Silent Data Theft With a Single Click

A critical flaw in Microsoft Copilot Personal, tracked as CVE-2026-24301 and dubbed CoSnitch, could allow attackers to silently steal sensitive information from a victim’s connected accounts after the victim clicks a malicious link. Microsoft patched the vulnerability on August 18, 2026, following responsible disclosure by Varonis Threat Labs. Lior Adar found no evidence that CoSnitch was exploited in the wild before the fix; the attack chain highlights the data-exposure…

Diamond Model