Ankura CTIX FLASH Update - October 28, 2025

Malware Activity

Phishing via Microsoft Copilot and Self-Spreading Malware in Developer Tools

Cybersecurity researchers have uncovered two significant threats affecting users and developers. First, they identified a new phishing technique called 'CoPhish' that exploits Microsoft Copilot Studio agents to deceive users into granting access through fake OAuth consent prompts. These malicious chatbot agents mimic legitimate Microsoft domaintricking users into clicking customized login buttons that redirect to harmful sites, steal session tokens, hijack accounts and in some cases, high-privilege admin roles. Although Microsoft plans to fix these issues in future updates, current vulnerabilities remain exploitable. Second, a sophisticated malware named GlassWorm has been discovered infecting Visual Studio Code extensions available on popular platforms. This self-spreading worm uses the Solana blockchain and Google Calendar as command-and-control centers to avoid