The IT Nerd

Researchers have discovered the first zero-click AI vulnerability dubbed “EchoLeak” that allows attackers to automatically exfiltrate sensitive and proprietary information from M365 Copilot context, without the user’s awareness, or relying on any specific victim behavior. Termed “LLM Scope Violation,” the new exploitation may have additional manifestations in other RAG-based chatbots and AI agents representing a major discovery advancement in how threat actors can attack AI agents – by leveraging internal model mechanics.

More details here:  https://www.aim.security/lp/aim-labs-echoleak-blogpost

Ensar Seker, CISO at SOCRadar had this to say:

“The EchoLeak discovery by Aim Labs exposes a critical shift in cybersecurity risk, highlighting how even well-guarded AI agents like Microsoft 365 Copilot can be weaponized through what Aim Labs correctly terms an “LLM Scope Violation.” This attack, which allows zero-click data exfiltration from an AI assistant’s context simply by sending an email, breaks from traditional breach tactics as it doesn’t require any user action beyond receiving mail. The fact that it bypasses server-side classifiers and markdown redaction rules demonstrates how these vulnerabilities are baked into agent-level logic, not just surface UI flows. 

“This has serious implications for NATO, government, defense, healthcare, and anyone using enterprise AI assistants: attackers no longer need to compromise user credentials or rely on phishing. They can manipulate a trusted AI interface directly. The multi-step EchoLeak chain is both elegant and insidious: it leverages retrieval-augmented generation (RAG), content-security-policy quirks, and markdown behavior to funnel data out silently to attacker-controlled URLs. 

“What stands out especially is that this isn’t limited to Copilot. As Aim Labs warns, any RAG-based agent that processes untrusted inputs alongside internal data is vulnerable to scope violations. This signals a broader architectural flaw across the AI assistant space – one that demands runtime guardrails, stricter input scoping, and inflexible separation between trusted and untrusted content.

“Organizations deploying AI agents must act quickly: disable external email ingestion in Copilot, enforce DLP tags, and apply prompt-level filters that block structured output or suspicious links. They should also treat every AI deployment with the same scrutiny reserved for enterprise applications integrating AI-specific security controls into DevSecOps and threat modeling. Insecure guards at the model layer are now as critical a risk as insecure interfaces at the network layer.

“EchoLeak is a watershed moment. It shows that AI agents can be their own attackers, and secure-by-design principles must evolve just as AI shifts from assistant to agent.”

Well, this isn’t good given the fact that AI is being deployed everywhere for everything. I think it’s a safe bet that we’ll be seeing more of this type of exploit going forward, and the danger of these sorts of exploits will only quickly increase.

Warlock, a new ransomware gang, today claimed credit for a spate of cyber-attacks that hit several government agencies from around the world. The group claimed responsibility for 16 cyber-attacks in the past month, and about half those hit government agencies and departments. 

In a blog post reporting this news, Paul Bischoff, Consumer Privacy Advocate at Comparitech, wrote:

“Also known as Warlock Dark Army, Warlock is a newer ransomware strain operated by cybercriminals. Once infected, Warlock encrypts data to make it inaccessible, then demands a ransom for the decryption key. It also steals data that it can use to extort targets by threatening to release private information.”

“Warlock could be connected to another ransomware group called Black Basta, which stopped claiming new attacks in January 2025. Warlock took credit for two attacks that Black Basta previously claimed against Arch-Con Corporation and Lactanet.”

“Comparitech researchers have tracked 79 confirmed ransomware attacks on government entities worldwide in 2025 to date. In 2024, we logged 199 such attacks in total. The average ransom demand is just over $2.4 million.”

“Ransomware attacks on government agencies and departments can both steal data and lock down computer systems. The attacker then demands a ransom to delete the stolen data and in exchange for a key to recover infected systems. If the target doesn’t pay, it could take weeks or even months to restore systems, data could be lost forever, and people whose data was stolen are put at greater risk of fraud.”

My stories on ransomware gangs never seem to end. I say that because I just finished writing about these guys, and now there’s a new gang on the block. This illustrates how out of control ransomware is and why urgent action is needed to get things in a better place.

Dermatologists of Birmingham this week confirmed it notified 86,414 people of a March 2025 data breach that compromised the following personal info:

• Names
• Social Security numbers
• Addresses
• Email addresses
• Phone numbers
• Dates of birth
• Medical diagnoses and treatments
• Health insurance info

Ransomware gang Qilin claimed responsibility for the attack, saying it stole 141 GB of data from the Alabama skin care practice, however the company has not verified Qilin’s claim.

In a blog post reporting this news, Paul Bischoff, Consumer Privacy Advocate at Comparitech, wrote:

“Qilin is a ransomware gang that began claiming responsibility for attacks on its data leak site in late 2022. Based in Russia, Qilin mainly targets victims through phishing emails to spread its ransomware. It launched in August 2022 and runs a ransomware-as-a-service business in which affiliates pay to use Qilin’s malware to launch attacks and collect ransoms.”

“Qilin took credit for 31 confirmed ransomware attacks in 2025 to date, plus 221 unconfirmed attack claims that haven’t been acknowledged by the targeted organizations. Hospitals and clinics are frequent targets for Qilin and other ransomware gangs. Last week, Next Step Healthcare confirmed it notified more than 12,000 people of a June 2024 data breach claimed by Qilin. The group also recently took credit for confirmed attacks on a hospital in Spain and an eye surgeon in Hungary.”

“Comparitech researchers have logged 27 confirmed ransomware attacks on US healthcare companies in 2025 so far, compromising more than 1.9 million records. Ransomware attacks on US hospitals, clinics, and other care providers can cripple critical systems and endanger the health, privacy, and security of patients. Hospitals must pay a ransom or face extended downtime, data loss, and putting patients and staff at increased risk of fraud. Hospitals and clinics might have to resort to pen and paper, cancel appointments, and divert patients elsewhere until systems are restored.”

Qilin is on a rampage as there’s this example, this example, this example, this example, this example, this example, this example, and this example. That’s a lot and it shows how dangerous this ransomware gang is. So organizations should consider themselves warned and take whatever measures are required to avoid being pwned by them.