NEW COPHISH ATTACK STEALS OAUTH TOKENS VIA COPILOT STUDIO AGENTS

Summary from the TLDR InfoSec newsletter

DataDog Security Labs identified a new phishing method exploiting Microsoft's Copilot Studio chatbots. Attackers can tailor the Login topic to create convincing phishing pages hosted on copilotstudio.microsoft.com. The attack involves administrators approving permission requests from the application, which can be a “demo website” that does not need Microsoft's verification.