That seems a bit of a non-story given that its prefaced on “once the attacker has access to your work email”. Yes once they have that they can do very good spear phishing attacks using copilot, but they could easily do them without copilot too.