以 M365 Copilot 为内鬼的金融交易劫持 (AML.CS0026)

一句话通俗理解

Copilot 摄取的邮件里藏着注入指令——AI「以你自己身份」执行了汇款操作。

案例速览

事件经过

Zenity 研究团队在 2024 年 8 月的红队演练中成功操纵了 Microsoft 365 Copilot：攻击利用 Copilot 摄取企业内容（邮件等）的特点，在其中埋入提示词注入，诱导 Copilot 以受信任内幕人员的身份执行金融交易劫持——展示了办公智能体被武器化为「内鬼」的路径。

运用的 ATLAS 技术

以下攻击链映射来自 MITRE ATLAS 官方数据（AML.CS0026 的 employs 关系），按官方步骤编号排序；技术名称链接至本库对应技术文档，引用文字为官方对本次运用的描述。

S00

• 收集 RAG 索引目标 (AML.T0064)

  The Zenity researchers identified that Microsoft Copilot for M365 indexes all e-mails received in an inbox, even if the recipient does not open them.

S01

• AI 产品或服务 (AML.T0047)

  The Zenity researchers interacted with Microsoft Copilot for M365 during attack development and execution of the attack on the victim system.

S02

• 特殊字符集 (AML.T0069.000)

  By probing Copilot and examining its responses, the Zenity researchers identified delimiters (such as ** and **END**) and signifiers (such as Actual Snippet: and “[^1^]”), which are used as signifiers to separate different portions of a Copilot prompt.

S03

• 系统指令关键词 (AML.T0069.001)

  By probing Copilot and examining its responses, the Zenity researchers identified plugins and specific functionality Copilot has access to. This included the search_enterprise function and EmailMessage object.

S04

• 检索内容构造 (AML.T0066)

  The Zenity researchers wrote targeted content designed to be retrieved by specific user queries.

S05

• LLM 提示词构造 (AML.T0065)

  The Zenity researchers designed malicious prompts that bypassed Copilot’s system instructions. This was done via trial and error on a separate instance of Copilot.

S06

• 通过公开应用进行提示词渗透 (AML.T0093)

  The Zenity researchers sent an email to a user at the victim organization containing a malicious payload, exploiting the knowledge that all received emails are ingested into the Copilot RAG database.

S07

• LLM 提示词混淆 (AML.T0068)

  The Zenity researchers evaded notice by the email recipient by obfuscating the malicious portion of the email.

S08

• RAG 投毒 (AML.T0070)

  The Zenity researchers achieved persistence in the victim system since the malicious prompt would be executed whenever the poisoned RAG entry is retrieved.

S09

• 虚假 RAG 条目注入 (AML.T0071)

  When the user searches for bank details and the poisoned RAG entry is retrieved, the Actual Snippet: specifier makes the retrieved text appear to the LLM as a snippet from a real document.

S10

• 间接提示词注入 (AML.T0051.001)

  The Zenity researchers utilized a prompt injection to get the LLM to execute different instructions when responding. This occurs any time the user searches and the poisoned RAG entry containing the prompt injection is retrieved.

S11

• AI 智能体工具调用 (AML.T0053)

  The Zenity researchers compromised the search_enterprise plugin by instructing the LLM to override some of its behavior and only use the retrieved EmailMessage in its response.

S12

• 引用（Citations） (AML.T0067.000)

  The Zenity researchers included instructions to manipulate the citations used in its response, abusing the user’s trust in Copilot.

S13

• 财务危害 (AML.T0048.000)

  If the victim follows through with the wire transfer using the fraudulent bank details, the end impact could be varying amounts of financial harm to the organization or individual.

关联战术

• 侦察 (AML.TA0002)
• AI 模型访问 (AML.TA0000)
• 发现 (AML.TA0008)
• AI 攻击适配 (AML.TA0001)
• 初始访问 (AML.TA0004)
• 防御规避 (AML.TA0007)
• 持久化 (AML.TA0006)
• 执行 (AML.TA0005)
• 影响 (AML.TA0011)

参考资料

以下为 MITRE ATLAS 官方案例收录的参考来源：

• Article from The Register with response from Microsoft

• We got an ~RCE on M365 Copilot by sending an email., Twitter

• Living off Microsoft Copilot at BHUSA24: Financial transaction hijacking with Copilot as an insider, YouTube

• MITRE ATLAS 官方案例页 (AML.CS0026)

版本: ATLAS 2026.09 | 更新: 2026-10-24 | 模板: ATLAS 案例研究 v1.0