Enrollment Hijacking

Expanded Definition

Enrollment hijacking is a control-plane attack against identity setup, not a password-cracking event. The attacker intervenes when an account is first binding an authenticator, then registers a credential they can later use to authenticate as the legitimate user or workload. In NHI and agentic AI environments, that can mean intercepting a device enrollment flow, hijacking a bootstrap token, or redirecting a one-time setup link before the intended owner completes provisioning.

The distinction matters because the account itself may be valid, but the trust relationship is already compromised at creation. That places enrollment hijacking alongside broader identity lifecycle abuse discussed in the OWASP NHI Top 10 and the OWASP Agentic AI Top 10, where secure bootstrap and identity binding are treated as first-class security concerns. Guidance varies across vendors on whether this is a subcategory of account takeover or a separate enrollment integrity issue, but the operational risk is the same: whoever controls enrollment can own the identity.

The most common misapplication is treating initial provisioning as a low-risk administrative step, which occurs when setup links, device pairing codes, or human approval paths are not strongly authenticated.

Examples and Use Cases

Implementing enrollment protections rigorously often adds friction to onboarding, requiring organisations to balance faster activation against stronger identity binding and auditability.

• A helpdesk issues a setup link for a new service account, and an attacker who has access to the mailbox completes enrollment first, binding their own authenticator before the real operator arrives.
• A mobile device enrollment QR code is exposed in chat or ticketing, allowing an attacker to register a trusted authenticator during initial device setup rather than during later login.
• An AI agent bootstrap token is copied from a build log and reused to register a rogue agent endpoint, turning a legitimate deployment flow into a silent takeover path. This pattern is consistent with the identity abuse discussed in the AI LLM hijack breach and the NIST AI Risk Management Framework.
• A new API client is provisioned with a temporary secret, but the secret is intercepted during handoff and used to finish registration with attacker-controlled credentials.
• An admin approves enrollment through a weak out-of-band channel, and the attacker spoofs the recipient workflow to attach their own authenticator to the account.

Research into compromised non-human identities shows how quickly stolen bootstrap material can become active. In Entro Security’s LLMjacking: How Attackers Hijack AI Using Compromised NHIs, exposed AWS credentials were attempted within 17 minutes on average, which is a useful reminder that enrollment artifacts are often exploited immediately after exposure.

Why It Matters in NHI Security

Enrollment hijacking is dangerous because it bypasses many of the controls defenders assume will catch account compromise later. If the attacker owns the first authenticator, MFA, device trust, rotation schedules, and access reviews may all validate the wrong party. That is especially damaging for NHIs and AI agents, where automated onboarding can create large volumes of identities and secrets quickly.

NHIMG research on agentic risk shows why this matters operationally: in the AI Agents: The New Attack Surface report, only 52% of companies can track and audit the data their AI agents access, leaving a large blind spot if enrollment is hijacked before monitoring begins. The same report notes that 80% of organisations have already seen agents act beyond intended scope, including revealing access credentials, which makes secure enrollment part of blast-radius reduction, not just onboarding hygiene.

Practitioners should align enrollment flows with strong identity assurance, short-lived bootstrap credentials, out-of-band verification, and immutable audit trails, as described in the NIST AI 600-1 Generative AI Profile and the CSA MAESTRO agentic AI threat modeling framework. Organisations typically encounter the true impact only after a rogue authenticator is detected during incident response, at which point enrollment hijacking becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• Why does MFA enrollment matter so much in NHI and IAM security?
• How can security teams reduce the risk of session hijacking in SaaS environments?
• Why does MFA not stop session hijacking?
• What is the difference between credential theft and session hijacking?