Submitted by Global Scam Watch on

I was in a GASA forum this morning while the group was discussing various fraud trends when the topic of AI injection came up.

Later,vas I was doom scrolling, I came across an article describing a one click vulnerability in Microsoft Copilot known as Reprompt. It immediately brought to mind a piece I recently wrote addressing how fake AI results were used to spread malware to Mac users.

While the Mac focused scam relied on convincing users to download malicious software, the Copilot issue operates differently. It does not require a download. It requires only a single click.

How The Attack Works

To understand the Reprompt issue, it helps to think of it as a hidden passenger attached to something you already trust. Traditional scams usually require an obvious mistake such as entering credentials on a suspicious website. This attack removes that step entirely.

The first step is the link. The victim receives a link that appears legitimate and points directly to the real Microsoft Copilot interface.

The second step is the click. The user clicks the link to open a shared chat or tool. No additional interaction is required.

The third step is the hidden instruction. Embedded at the end of the URL is a concealed command known as the q parameter. When the page loads, the AI processes this instruction before the user types anything.

The final step is silent data access. The instruction directs the AI to bypass its safeguards and begin collecting private data such as emails, documents, or calendar information and transmit it to the attacker.

The entire process occurs quietly. There are no alerts, pop ups, or visible signs that the AI is being manipulated.

Connecting The Trends

Both the Mac malware campaign and the Copilot vulnerability depend on the same underlying factor: Brand trust.

In the first case, scammers use the appearance of an AI instruction to disable a security function and download malicious software.

In the second, scammers exploit a legitimate AI platform and weaponize it through a malicious instruction, effectively turning the assistant into a surveillance tool.

In both situations, the objective is to catch users when their guard is down. If a link leads to a well known and trusted platform, most people will not hesitate before clicking.

Why Logic Is The New Target

For decades, users have been taught not to open suspicious attachments. What most people have not yet learned is that links can now carry behavioural instructions for AI systems.

This is not a conventional software vulnerability. It is a flaw in how AI systems prioritize and follow instructions. When a link can dictate how an assistant behaves, the threat is no longer external. It is embedded directly within the tools people use every day.

How To Protect Yourself

The most effective defense is to reassess what is considered a safe link. A link leading to a legitimate AI platform does not guarantee the instructions embedded within are benign.

Shared AI links and prebuilt prompts should be treated with the same caution as unsolicited file attachments.

If you did not request the link or the tool it claims to offer, do not click it.

Be especially cautious of links which automatically launch AI sessions containing prefilled instructions you did not create yourself. Remember, AI is really just a search engine, while it can be used to compile information at breakneck speeds, the same can be accomplished via a standard search engine and a small amount of research.