EchoLink and rise of Zero-Click AI exploits - ITREALMS

ITREALMS ... making leadership SENSE with digital news!

Cybersecurity researchers at Check Point have uncovered a critical zero-click vulnerability in Microsoft 365 Copilot, dubbed “EchoLink”, which allows attackers to extract sensitive corporate data without any user interaction.

The exploit, which has since been patched by Microsoft, is described as a potential watershed moment in AI-driven cybercrime, leveraging hidden prompts embedded in everyday business content such as Word documents, calendar entries, and emails.

When Microsoft 365 Copilot processes this seemingly innocuous material, it unknowingly executes the malicious commands.

According to Check Point, the attack is silent and automatic. Users are unaware as Copilot reveals confidential data such as internal reports, meeting summaries, or strategic documents—all without requiring a single click or download.

“This marks the beginning of a new era of cyberattacks—where AI is not just the target, but the tool,” says Hendrik de Bruin, Head of SADC Security Consulting, Check Point Software Technologies.

“EchoLink shows how attackers can manipulate large language models in ways that bypass traditional security controls.”

The zero-click nature of the vulnerability has raised alarms across the enterprise sector. Experts warn that such exploits could rapidly evolve, especially as more businesses adopt AI assistants to handle sensitive workflows.
"This isn’t just another flaw – it’s a new class of threat. One that doesn’t require a single click, a download, or any user interaction to trigger. EchoLink is invisible, fast-moving, and capable of silently leaking sensitive enterprise data," says de Bruin.


For organisations heavily invested in Microsoft’s productivity suite, EchoLink is a serious red flag.


"Many rely on Microsoft’s native security tools or try to patch gaps with multiple point solutions. But this fragmented, layered approach can lead to weak links and bling spots, introducing more risk than protection," de Bruin says.