Criminals Spoof AI Agents via BluePhishing Scam

Security researchers at Proofpoint discovered a new scam called BluePhishing where attackers spoof Microsoft Entra Agent ID blueprints to gain corporate access. A single approved blueprint can spawn up to 250 agent identities, creating a swarm of malicious bots that exfiltrate data. Experts warn organizations must restrict third-party agent consent and apply least-privilege controls immediately to prevent this breach.