Security firm Proofpoint reports 'BluePhishing' scam abusing Microsoft Entra Agent ID blueprints to inject malicious AI agents
Proofpoint found attackers use social engineering to trick users into approving malicious AI agent blueprints, creating up to 250 unauthorized identities in Microsoft corporate environments.
Cybersecurity firm Proofpoint has published a report detailing a new attack technique dubbed "BluePhishing." The method exploits Microsoft's Entra Agent ID system by using social engineering to trick enterprise users into approving malicious AI agent blueprints, thereby injecting controlled AI agents into target corporate networks.
Entra Agent ID is an extension of Microsoft Entra that allows organizations to create digital identities for AI agents and manage their access permissions. To simplify deployment, Microsoft introduced "agent blueprints," templates used to batch-create multiple AI agent identities with specific permissions. Proofpoint's research shows that attackers can create a blueprint configured with malicious permissions in their own Microsoft environment and then generate a link pointing to a genuine Microsoft authorization page.
Unlike traditional phishing attacks, this technique does not require spoofing a login page. Attackers only need basic information about the target organization, such as its tenant ID and details of a specific user, to send the link via email or instant messaging. When the victim clicks the link and approves the blueprint in the authentic Microsoft consent popup, the malicious AI agent gains entry to the corporate environment. Once inside, the agent can leverage the AgentIdentity.CreateAsManager permission to clone itself, with a single blueprint capable of generating up to 250 distinct malicious agent identities, each holding tokens with access to internal company resources.
Proofpoint recommends that enterprises restrict third-party agent consent, apply least-privilege controls, and monitor audit logs for agent creation events. Since the malicious agent blueprint ID remains consistent across all tenants that grant consent, it serves as an indicator for detecting and removing known malicious agents.