Forest Global Training Partners

Cyber Risks · The Hacker News

OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials

Summary: Proofpoint reported that at least two threat actors are using OAuth client ID spoofing to enumerate accounts and validate stolen credentials in Microsoft Entra ID environments without generating a successful sign-in event. The technique sends HTTP POST requests to Microsoft's OAuth 2.0 token endpoint using the Resource Owner Password Credentials flow with syntactically valid but non-existent client IDs, and AADSTS error codes reveal whether an account exists and whether the password is correct. Two large campaigns adopted the technique toward the end of December 2025: UNK_OutFlareAZ generated a unique client ID per request and enumerated users alphabetically, while UNK_pyreq2323 modified trailing digits of a known application ID and reused spoofed IDs across up to 12 users.

Bottom line: Entra sign-in logs record only the application ID with no application name when a spoofed client ID is used, so detections that look for surges against a specific application name and Conditional Access policies scoped to specific applications will not fire. Proofpoint's Yaniv Miron said other identity providers may be exposed to the same issue, meaning the blind spot may not stop at Microsoft.

Read the original at The Hacker News ↗

Topics
Data Breaches
Related