Proofpoint Uncovers BluePhishing Attack Targeting Microsoft Entra Agent Identities
Security researchers introduced a new cloud intrusion technique called the BluePhishing attack. This attack adapts classic OAuth consent abuse to artificial intelligence ecosystems. By tricking a user into approving a malicious third-party blueprint, the BluePhishing attack Entra Agent ID method allows intruders to create up to 250 local agent identities inside a target network. Although no real-world campaigns have used this vector yet, default Microsoft 365 configuration changes in November 2026 significantly expand enterprise exposure.
As enterprises integrate autonomous helpers into their cloud workflows, Microsoft Entra Agent ID extends traditional application frameworks to manage artificial intelligence identities. According to a report on BluePhishing initial access via third-party agent blueprint consent by Proofpoint researchers, this new architecture inherits many of the same security risks found in standard OAuth applications. In this model, an agent blueprint acts like an app registration. Meanwhile, a blueprint principal functions like a service principal inside a tenant.
Linha do tempo
-
Proofpoint Uncovers BluePhishing Attack Targeting Microsoft Entra Agent Identities
ler a análise desta fonte ocultar
Security researchers introduced a new cloud intrusion technique called the BluePhishing attack. This attack adapts classic OAuth consent abuse to artificial intelligence ecosystems. By tricking a user into approving a malicious third-party blueprint, the BluePhishing attack Entra Agent ID method allows intruders to create up to 250 local agent identities inside a target network. Although no real-world campaigns have used this vector yet, default Microsoft 365 configuration changes in November 2026 significantly expand enterprise exposure.
As enterprises integrate autonomous helpers into their cloud workflows, Microsoft Entra Agent ID extends traditional application frameworks to manage artificial intelligence identities. According to a report on BluePhishing initial access via third-party agent blueprint consent by Proofpoint researchers, this new architecture inherits many of the same security risks found in standard OAuth applications. In this model, an agent blueprint acts like an app registration. Meanwhile, a blueprint principal functions like a service principal inside a tenant.