Zenity Labs

A Summary of Zenity Research Published at BlackHat 2024

New Attack Vectors Discovered for Initial Access and Post-Compromise

Copilot Vulnerable to RCE: A New Attack Vector Into The Enterprise

We Need To Address Promptware Now

Phantom References in Microsoft Copilot

Links and materials for Living off Microsoft Copilot

Links, source code, tools and slides for BlackHat USA 2024

Indirect Prompt Injection: Advanced Manipulation Techniques

Links and materials for 15 Ways to Break Your Copilot

Links, source code, tools and slides for BlackHat USA 2024

Indirect Prompt Injection: From Initial Success to Robustness

Research Drop for Hacker Summer Camp 2024

More information on hacking Microsoft Copilot, Copilot Studio, powerpwn, and what to do next

RAG Poisoning: All You Need is One Document

Phishing is Dead, Long Live Spear Phishing

How Copilot Reads Your Emails and Teams Messages

A Look Inside Microsoft Copilot’s RAG System