Security researchers at Proofpoint have described an attack technique that allows attackers to gain access to a Microsoft Entra tenant through the identity of an AI agent. With BluePhishing, an attacker gets a user to approve a malicious agent blueprint via the standard consent process. The technique is a proof of concept, and no abuse has yet been observed in the wild.
BluePhishing builds on app consent phishing, a well-known technique in which attackers use social engineering to trick users into granting consent to a malicious application. The new variant revolves around agent blueprints within Microsoft Entra Agent Identity, the Entra extension for managing the identities of AI agents. According to Proofpoint, this model closely resembles the existing application model in Entra and is therefore open to many of the same forms of abuse. The researchers describe the technique in the blog post BluePhishing: Initial Access via Third-Party Agent Blueprint Consent.
How the technique works
An attacker creates an agent blueprint in their own tenant and configures it with delegable permissions and the requiredResourceAccess (RRA) property. They then send the target a consent link. If a user approves the request through Entra’s standard consent process, the attacker can create agent identities in the victim’s tenant. This enables them to obtain access tokens and act with the permissions granted to those agents.
According to the researchers, the attack requires four pieces of information. The attacker generates two of these in their own tenant: the blueprint’s application ID and a client secret. In addition, they need to know the victim’s tenant ID, as well as a sponsor. This is a user in the victim’s tenant who is required to create the agent identity. Proofpoint notes that the attacker relies on traceable identifiers in the process, such as the tenant ID and the object ID of the user or sponsor.
How it differs from classic consent phishing
As with app consent phishing, the attacker operates using a legitimate identity to which a user has granted consent, meaning the activity takes place within a trusted context. Proofpoint argues that the agent identity framework gives attackers additional capabilities on top of this.
The researchers point out that awareness of this attack vector is still low. In their view, users may be more inclined to authorise an AI agent without considering the security implications. An application requesting broad permissions may arouse suspicion. Autonomous behaviour, by contrast, is a defining characteristic of agents and is therefore more readily accepted, particularly in environments where many agent identities are already active.
Scale also plays a role, according to Proofpoint. A single blueprint can create up to 250 agent identities. The company states that limitations in visibility and governance around agent identities and consent processes increase the risk of automated post-exploitation at scale.
No abuse observed yet
BluePhishing is a research-based proof of concept. Proofpoint reports that it has so far not detected any activity in the wild indicative of this technique. However, the company believes that emerging techniques such as this one should be monitored as the technology develops and policies around new identity frameworks change.
For administrators of Entra environments, the obvious step is to apply the same controls to agent identities as to third-party applications. These include restricting who may grant consent to external blueprints, reviewing granted permissions and monitoring newly created agent identities.
The full report can be read at BluePhishing: Initial Access via Third-Party Agent Blueprint Consent.
This article was originally published in Dutch on MSP Business. Read the original →
