Varonis Threat Labs disclosed on August 18 a three-vulnerability chain, CVE-2026-24301, nicknamed CoSnitch, that let attackers gain full read access to Gmail, Google Drive, and Outlook through Microso…
Varonis Threat Labs disclosed CoSnitch, a chain of three flaws in Microsoft Copilot Personal tracked as CVE-2026-24301 and rated 8.8 on the CVSS 3.1 scale, which allowed one click on a link to run att…
Researchers at Varonis Threat Labs discovered CoSnitch, a one-click vulnerability in Microsoft Windows Copilot that allows attackers to exfiltrate sensitive data using Copilot's access to the computer…
Varonis Threat Labs discovered a critical vulnerability in Microsoft Copilot Personal, tracked as CVE-2026-24301 and nicknamed 'CoSnitch,' which allowed attackers to exfiltrate sensitive data from con…
Varonis Threat Labs disclosed CoSnitch on August 18, a one-click attack chain in Microsoft Copilot Personal that could automatically execute an attacker-supplied prompt, exfiltrate data through connec…
Varonis Threat Labs disclosed a one-click vulnerability in Microsoft Copilot Personal, dubbed CoSnitch, that enables data exfiltration from enterprises via an attack chain that exploits three flaws, i…
Varonis Threat Labs discovered a vulnerability in Microsoft Copilot Personal, named CoSnitch, that allowed researchers to trick the AI into revealing how to hack itself, including an undocumented 'aut…
Varonis Threat Labs disclosed a vulnerability in Atlassian's Rovo AI assistant, dubbed RovoBlast, that allows attackers to steal enterprise data with a single click via a parameter-to-prompt injection…
A single click on a crafted link could have let attackers hijack Atlassian's Rovo AI assistant and steal sensitive enterprise data across Jira, Confluence, SharePoint, and more, according to Varonis T…
Varonis Threat Labs disclosed a vulnerability in Atlassian's Rovo AI assistant, dubbed RovoBlast, where a single click on a crafted link can trigger attacker-embedded instructions and force Rovo to ac…
Varonis Threat Labs discovered Dolphin X, a malware advertised on a cybercrime forum by a vendor using the alias “Kontraktnik,” that targets more than 300 applications including cryptocurrency wallets…
A new Windows information-stealer called Dolphin X, sold on a cybercrime forum by a vendor using the alias Kontraktnik, targets more than 300 applications and includes an AI profiler that ranks infect…
Varonis Threat Labs disclosed a Google Dialogflow CX flaw, dubbed Rogue Agent, on July 7, 2026, that could allow attackers with playbook update permission to persist malicious code inside enterprise c…
Varonis Threat Labs discovered a critical vulnerability in Google Cloud Platform's Dialogflow CX service, allowing attackers to hijack AI conversations, steal data, and launch further attacks. The fla…
Varonis Threat Labs researchers Doron Kapah and Mark Vaitsman launched Breach at the Beach, a Capture The Flag (CTF) training experience designed to teach security practitioners how to detect and resp…
Varonis Threat Labs disclosed a critical vulnerability chain called SearchLeak in Microsoft 365 Copilot Enterprise that could allow attackers to exfiltrate emails, MFA codes, and files via a one-click…
Varonis Threat Labs discovered a three-stage vulnerability chain called SearchLeak in Microsoft 365 Copilot Enterprise Search that allows attackers to exfiltrate sensitive data with a single click. Th…
Security researchers at Varonis Threat Labs disclosed a vulnerability chain in Microsoft 365 Copilot Enterprise Search, dubbed SearchLeak, that could allow attackers to steal emails, calendar data, an…
Varonis Threat Labs disclosed a critical one-click data-exfiltration vulnerability in Microsoft 365 Copilot Enterprise Search, tracked as CVE-2026-42824. The attack chains a parameter-to-prompt inject…
Varonis Threat Labs researchers created an OpenClaw autonomous email agent named "Pinchy" and ran four controlled phishing simulations that resulted in the exfiltration of AWS IAM keys, database crede…