NewsProofpoint Threat InsightFinanceSME

    BluePhishing: Initial Access via Third-Party Agent Blueprint Consent

    Share
    Key TakeawaysMicrosoft Entra Agent Identity extends Entra to AI agents and closely mirrors the traditional application model, inheriting many of the same opportunities for abuse.Proofpoint researchers present “BluePhishing” as the next evolution of OAuth consent abuse, enabling attackers to leverage agent identities for initial access.Attackers can configure the blueprint with inheritable permissions and requiredResourceAccess (RRA), using consent links to gain initial access to a victim tenant.Consent to a malicious blueprint allows an attacker to establish agent identities and operate with…

    Source: https://www.proofpoint.com/us/blog/threat-insight/BluePhishing-Initial-Access-via-Third-Party-Agent-Blueprint-Consent

    ID