BluePhishing: Initial Access via Third-Party Agent Blueprint Consent
Proofpoint researchers have identified 'BluePhishing,' a novel attack method that exploits Microsoft's Entra Agent Identity framework to gain initial access to organizations' systems through malicious agent blueprints.
As organizations increasingly adopt AI technologies, Microsoft's Entra Agent Identity framework introduces new capabilities while creating largely uncharted attack surfaces. BluePhishing extends classic OAuth consent abuse techniques to target AI agent ecosystems, allowing attackers to establish initial access through socially engineered consent to malicious agent blueprints.
The attack works by exploiting governance gaps around emerging AI agent adoption. Attackers configure malicious blueprints with inheritable permissions and required resource access (RRA), then use consent links to gain initial access to victim tenants. Once consent is granted, attackers can establish agent identities and operate with the privileges assigned to those agents.
Agent Identity Framework
Microsoft Entra Agent ID extends Entra to AI agents and mirrors the traditional application model, inheriting similar abuse opportunities. An agent blueprint serves as a template for agents, defining configuration and credentials, while the blueprint principal represents this blueprint within a tenant. Agent identities are specific instances created from blueprints, with up to 250 identities allowed per blueprint.
This framework introduces significant governance challenges, as permissions inherited by agent identities may not be visible in the Entra portal or via Microsoft Graph, limiting defenders' audit capabilities. Microsoft plans to allow default users to create agent blueprints by November 2026, potentially increasing organizational exposure to such attacks.
Attack Mechanics
To conduct a BluePhishing attack, attackers need to configure an agent blueprint in their own tenant with specific properties including sign-in audience, application and delegated permissions, and required resource access with inheritable permissions. The signInAudience must be set to AzureADMultipleOrgs to enable external consent.
While designed to simplify agent deployment, RRA and inheritable permissions can be used by an adversary to bundle broad permissions into a single one-time consent link, and ensure the consented permissions are automatically inherited across all agent identities.
Attackers then construct consent links that victims must approve. These links require minimal information from the victim, including tenant ID and sponsor user details, which can be easily obtained through publicly documented methods. Once consent is granted, blueprint principals are created in the victim tenant with the AgentIdentity.CreateAsManager permission, allowing attackers to create additional agent identities.
Consent Types and Impact
BluePhishing can exploit both user and admin consent flows. Admin consent provides more powerful permissions across the entire tenant but requires the victim to have appropriate privileges. User consent targets broader ranges of lower-privileged users but is limited to delegated permissions that cannot be redeemed via autonomous flows.
The attack creates persistent access through agent identities that inherit permissions from the malicious blueprint. This enables attackers to operate with granted privileges using discoverable identifiers like tenant ID and user/sponsor object IDs, potentially leading to scalable and automated post-exploitation.
Proofpoint has not yet identified any in-the-wild BluePhishing activity but emphasizes that emerging techniques should be carefully tracked as technology advances and policies surrounding new identity frameworks evolve. The company notified Microsoft about the attack before publishing details.
Related
