A hot and busy week at Hacker Summer Camp 2024

This week at Hacker Summer Camp 2024, our team will drop a significant amount of new research. This post will be an ever-growing list of technical blogs and resources as the week progresses.

Dropped research - hack away!

Talks:

• Living off Microsoft Copilot 

• 15 Ways to Break Your Copilot

Tools:

• CopilotHunter

  • Deep scan module to scan the Internet

  • Enum module to scan your tenant

• LOLCopilot

  • whoami module to collect sensitive info that the compromised user has access to

  • Dump module to collect the data from whoami, abusing copilot DLP bypass

  • Spearphishing module to spear phish every person that recently collaborated with the victim account

Technical blog posts:

• Phantom References in Microsoft Copilot

• Indirect Prompt Injection: Advanced Manipulation Techniques

• Indirect Prompt Injection: From Initial Success to Robustness

• RAG Poisoning: All You Need is One Document

• Phishing is dead, long live Spear Phishing

Subscribe so you won’t miss more content ^_^

What to expect

• BlackHat talk: 15 Ways to Break Your Copilot (Wed, Aug 7th, 11:20am PT)

• BlackHat talk: Living off Microsoft Copilot at BlackHat USA 2024 briefings (Thur, Aug 8th, 11:20am PT)

• BlackHat Arsenal: Living of O365 with powerpwn (Wed, Aug 7th, 12:40am PT)

• PowerPwn v3, including more modules, better error handling and addressed feedback to make your hacking most convenient.

• CopilotHunter - a recon and exploitation tool that scans for publicly accessible Copilots and uses fuzzing and GenAI to abuse them to extract sensitive enterprise data.

• LOLCopilot - a red-teaming tool abusing Microsoft Copilot for living off the land.

• And a daily technical blog!

• Meet us in person, we’ll be here all week.

But since you have no patience and are stuck on a flight - we released some reading materials so you can start having fun early!