Hackers Could Abuse Microsoft Entra AI Agents to Hijack Enterprise Accounts Without Stealing Passwords

Researchers discovered BluePhishing, a new attack technique leveraging Microsoft Entra AI agents to hijack enterprise accounts without stealing credentials. Attackers trick users into approving fake AI agents, exploiting OAuth consent mechanisms. This poses significant risk to Microsoft 365 environments and email security infrastructure.

https://cybersecuritynews.com/hackers-could-abuse-microsoft-entra-ai-agents/