NetSec News Articles of Interest From the Week of July 21, 2025
Read more cybersecurity news in this edition of NetSec News.
Breaking down ‘Echoleak’, the first zero-click AI vulnerability enabling data exfiltration from Microsoft 365 Copilot
Researchers discovered “EchoLeak,” a vulnerability exploiting design flaws in RAG Copilots, enabling attackers to automatically extract data from M365 Copilot’s context without specific user actions. The primary exploit chain involves three distinct vulnerabilities, with additional vulnerabilities identified during research that may also enable attacks. (Aim Labs)
 |
|
“That’s a great example of how challenging it will be to implement AI securely across the board. Like nearly all other vulnerabilities, the primary attack surface is user input (leading to prompt injection in this case). Since Copilot has access to data from a wide range of MS 365 services, it’s likely we’ll see additional variations of this attack crop up.” –Chase Theodos, Threat Detection Specialist at C3 Integrated Solutions |
Hackers inject malware into gravity forms WordPress plugin
Two trojanized versions of the Gravity Forms WordPress plugin were distributed through the official download page following a supply chain attack. (SecurityWeek)
McDonald’s AI bot spills data on job applicants
McDonald’s has outsourced the initial stages of its hiring process to an AI chatbot which seems to have been built without proper security measures. Security researchers managed to extract personal information about McDonald’s job applicants by simply guessing a username and the password “12345.” In doing this, the researchers could have potentially gained access to the information of 64 million applicants. (Malwarebytes)
Grok-4 falls to a jailbreak two days after its release
The latest release of the xAI LLM, Grok-4, has already fallen to a sophisticated jailbreak. (SecurityWeek)
Meet the Author
