New 'BluePhishing' Scam Exploits Microsoft Entra AI Agent Blueprints
Attackers leverage legitimate Microsoft authorization flows to infiltrate corporate environments with malicious AI agents.
1Exploiting AI Agent Blueprints
Security researchers at Proofpoint identified a vulnerability involving Microsoft Entra Agent ID blueprints. Attackers can create malicious templates and trick corporate users into authorizing them. Once approved, these blueprints allow threat actors to inject unauthorized AI agents directly into a company's internal environment, bypassing traditional security filters through legitimate authorization channels.
2The Mechanics of BluePhishing
The attack begins with an attacker configuring a malicious blueprint within their own controlled Microsoft environment. They generate a link leading to a genuine Microsoft authorization page, making the phishing attempt appear entirely authentic. By targeting specific users with social engineering, attackers convince victims to grant permissions to these rogue AI agents.
3Escalation Through Identity Cloning
Once the initial malicious agent is installed, it utilizes the AgentIdentity.CreateAsManager permission to expand its reach. A single approved blueprint can spawn up to 250 distinct agent identities within the target organization. This swarm of bots allows attackers to perform various malicious tasks simultaneously while maintaining a presence inside the corporate network.
4Leveraging Admin Privileges
The potential impact of this attack depends heavily on the victim's authorization level. If an administrator approves the blueprint, the malicious agent may gain organization-wide application permissions. Even if an ordinary user approves the request, the agent can still access specific delegated resources, depending on the company's existing internal security policies.
5Data Exfiltration Risks
After successfully deploying the agents, attackers obtain valid access tokens for these identities. These tokens grant the malicious bots status as legitimate members of the organization. Consequently, the attackers can access various corporate resources and exfiltrate sensitive data, as the system treats these rogue agents as authorized internal service entities.
6Restricting Third-Party Consent
Proofpoint advises organizations to strictly limit user consent settings for third-party agents. Much like standard application consent controls, these settings are crucial for preventing unauthorized blueprints from gaining a foothold. Companies should ensure that only trusted sources are permitted to deploy AI agents within their specific Microsoft Entra tenant environment.
7Applying Least-Privilege Controls
Implementing the principle of least privilege is essential to mitigating the damage from potential agent compromises. Organizations should utilize Conditional Access policies specifically tailored for AI agents and leverage Entra ID protection features. These controls restrict the scope of what any single agent can access, even if it is successfully authorized.
8Monitoring and Audit Logs
Security teams must monitor agent and blueprint creation events surfaced in audit logs. These logs function similarly to standard app consent operations, providing visibility into suspicious activity. Since blueprint IDs remain consistent across tenants, security administrators can use this indicator to detect, identify, and remove known malicious agents from their systems.