BluePhishing Technique Abuses Microsoft Entra AI Agents for Account Hijacking
Researchers have identified a novel technique called BluePhishing that exploits Microsoft Entra AI Agents to hijack enterprise accounts without requiring stolen credentials.
A new technique dubbed "BluePhishing" has been uncovered by researchers, demonstrating how attackers can compromise enterprise accounts within Microsoft 365 environments by tricking users into approving a malicious AI agent blueprint. This method bypasses traditional credential theft and phishing tactics by leveraging the emerging capabilities of Microsoft Entra Agent ID, the system that grants AI agents distinct identities within a company's cloud tenant.
The BluePhishing technique builds upon the well-established concept of OAuth consent phishing. Instead of tricking users into granting permissions to a fake application, attackers now target the consent mechanisms for AI agents. This is particularly concerning as Microsoft plans to broaden the ability for regular Entra users to create agent blueprints by default starting in November 2026, potentially increasing the attack surface.
Proofpoint researchers detailed the BluePhishing technique in a report, noting it is a research-based proof of concept and has not yet been observed in the wild. They have notified Microsoft of the vulnerability. The attack involves an attacker first creating a malicious agent blueprint in their own tenant, embedding broad permissions, and then configuring it to allow cross-organizational consent. This blueprint is then shared with the victim.
When a user in the victim's tenant approves the consent request for the blueprint, a blueprint principal is created within their environment. Crucially, this principal automatically receives the AgentIdentity.CreateAsManager permission, which Proofpoint states cannot be revoked. This elevated permission allows the attacker to request a Microsoft Graph API token.
With the Graph token, the attacker can then create agent identities within the victim's tenant. The necessary information for this step—the blueprint ID and secret, along with the victim's tenant ID—is not considered highly secret. The tenant ID, for instance, can often be discovered through public sign-in lookups, making the attack more feasible.
Once an agent identity is created, it can be loaded into tools like GraphRunner to execute arbitrary Microsoft Graph API requests. Researchers demonstrated this by creating an agent with User.Read.All and Group.Read.All permissions, showcasing the potential for extensive data exfiltration and further compromise.
Defenders may find it challenging to detect BluePhishing attacks because AI agent activity can appear legitimate. Furthermore, consent controls for agents are less mature than for traditional applications, and inherited permissions are not always visible in standard administrative interfaces, only appearing at runtime within tokens. Tracing agent actions requires careful analysis across multiple log sources.
Proofpoint recommends several mitigation strategies, including educating staff about the risks of third-party agent permissions, applying user consent limits to agent blueprints, using permission classifications, enforcing least privilege, implementing Conditional Access policies for agents, and monitoring audit logs for suspicious activities like "Add application" (blueprint creation) and "Add service principal" (agent identity creation).