m365-entra-attack

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (critical risk: 1.00). This document is a step-by-step offensive playbook for compromising Microsoft 365/Entra tenants, including reconnaissance, user enumeration, password-spray/ROPC code, Conditional Access bypass techniques, and tooling to validate and exploit credentials.

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill's code and templates explicitly take and embed plaintext passwords (e.g., POST form "password" field, Playwright .fill(password), and report lines showing ":"), which requires the LLM/agent to handle and output secret values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow ingests outsider-authored free text at runtime by using attacker-provided target identifiers (e.g., corporate email list / leaked-cred dumps, “target uses M365 / Entra ID” triggers) and then sending those strings into login and browser/SAML flows, creating LLM exposure to free-form user input (emails/passwords/SP URLs) without selecting a specific trusted item first.