[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fsesc2ncQkS8JW5GMKXZjixPhY9szH6ZuFGLEt2Weo5I":3},{"article":4,"iocs":53,"watch_terms":54,"solutions":55,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"7557dfcc-4538-4e10-9f13-0173c9c8e308","Hackers Could Abuse Microsoft Entra AI Agents to Hijack Enterprise Accounts Without Stealing Passwords","hackers-could-abuse-microsoft-entra-ai-agents-to-hijack-enterprise-accounts-with-5a0001","Researchers have shown that attackers can take over parts of a Microsoft 365 environment by tricking one person into approving a fake AI agent. No password is stolen and no login screen is faked. The technique is called BluePhishing. It targets Microsoft Entra Agent ID, the system that gives AI agents their own identities inside […] The post Hackers Could Abuse Microsoft Entra AI Agents to Hijack Enterprise Accounts Without Stealing Passwords appeared first on Cyber Security News.","Researchers have discovered a new technique called BluePhishing that allows attackers to compromise Microsoft 365 environments by tricking users into approving malicious AI agents. This method bypasses traditional password theft and login screen spoofing by exploiting Microsoft Entra Agent ID and OAuth consent phishing principles. Proofpoint researchers identified the technique but have not yet observed it in real-world attacks.","Hackers can hijack enterprise accounts by tricking users into approving fake AI agents.","https:\u002F\u002Fcybersecuritynews.com\u002Fhackers-could-abuse-microsoft-entra-ai-agents\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FHackers-Could-Abuse-Microsoft-Entra-AI-Agents-to-Hijack-Enterprise-Accounts-Without-Stealing-Passwords.webp","2026-11-11T17:17:04+00:00","2026-11-11T18:00:30.246208+00:00",8,[17,20,23,25,28],{"name":18,"type":19},"Microsoft 365","product",{"name":21,"type":22},"Microsoft Entra Agent ID","technology",{"name":24,"type":22},"OAuth",{"name":26,"type":27},"Proofpoint","vendor",{"name":29,"type":22},"Microsoft Graph","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":30,"icon":32,"name":33,"slug":34},null,"Threat Intelligence","threat-intelligence",[36,41,46,51],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":52},{"id":30,"icon":32,"name":33,"slug":34},[],[26,18],{"controls":56,"vendors":134},[57,86,108],{"slug":58,"name":59,"problem":60,"products":61},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":87,"name":88,"problem":89,"products":90},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},{"slug":109,"name":110,"problem":111,"products":112},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[113,121,126],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-ai-gateway","Boomi AI Gateway","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fai-gateway\u002F","Gateway for AI model and MCP tool traffic, built on Lunar.dev technology. It limits which tools each agent can call. Its enterprise version adds an approval step for new MCP servers and logs each call with the user or agent behind it.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":122,"product_name":123,"url":124,"description":125},"boomi-agentstudio","Boomi Agentstudio","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fagentstudio\u002F","Agent builder whose Agent Control Tower registers and monitors Boomi agents and agents on Amazon Bedrock, Microsoft Copilot and other platforms, keeps audit logs and can switch agents off where the provider allows it.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"hiddenlayer","HiddenLayer","\u002Fvendor-logos\u002Fhiddenlayer.png","hiddenlayer-ai-security","HiddenLayer AI Security Platform","https:\u002F\u002Fhiddenlayer.com\u002F","Model scanning, AI red teaming and runtime protection for AI applications.",[135,138],{"slug":71,"name":72,"logo_path":73,"roles":136},[137],"affected",{"slug":139,"name":26,"logo_path":140,"roles":141},"proofpoint","\u002Fvendor-logos\u002Fproofpoint.png",[142],"reported_by",{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":153},"bluephishing-ai-agent-oauth-consent-abuse-bypasses-password-based-defenses","BluePhishing: AI Agent OAuth Consent Abuse Bypasses Password-Based Defenses","Attackers discovered a technique to compromise Microsoft 365 environments by deceiving users into granting OAuth consent to malicious AI agents registered in Microsoft Entra, entirely bypassing the need to steal passwords or spoof login pages. Because users are conditioned to approve OAuth permission prompts without scrutinizing what access they are actually delegating, this social-engineering vector is highly effective. The abuse of legitimate platform features—Agent IDs and OAuth flows—makes the attack difficult to detect with traditional credential-monitoring tools. This highlights that as AI-integrated platforms expand delegated permission models, users and administrators must treat agent\u002Fapp consent requests with the same suspicion as phishing emails.",[148,149,150,151,152],"MITRE ATT&CK T1528: Steal Application Access Token","NIST SP 800-53 AC-3: Access Enforcement","NIST SP 800-53 AC-6: Least Privilege","NIS2 Article 21(2)(g)","CIS Control 6: Access Control Management",{"NIS2 Article 21(2)(g)":154,"NIST SP 800-53 AC-6: Least Privilege":155,"NIST SP 800-53 AC-3: Access Enforcement":156,"CIS Control 6: Access Control Management":157,"MITRE ATT&CK T1528: Steal Application Access Token":158},"This incident exploits a gap in user awareness about OAuth and AI agent consent prompts, which basic cyber hygiene training and security awareness programs are specifically required to address.","Enforcing least privilege on agent and application permission scopes would limit the damage a successfully consented malicious AI agent could cause within the Microsoft 365 environment.","AC-3 requires enforcing approved authorizations for access to systems and resources, which—applied to OAuth consent—would restrict which agents and apps can be granted delegated permissions.","CIS Control 6 calls for centrally managing access grants, including OAuth application consents, which would prevent unprivileged users from independently authorizing malicious agents.","BluePhishing manipulates users into granting OAuth tokens to malicious agents, achieving the same delegated access as token theft without ever obtaining credentials."]