OAuth Client ID Spoofing Exploits Blind Spot in Microsoft Entra ID to Validate Stolen Credentials

Proofpoint has uncovered a novel evasion technique called OAuth client ID spoofing, exploited by at least two threat actors to validate stolen credentials in Microsoft Entra ID environments without generating successful sign-in events. The technique exploits a blind spot in cloud sign-in telemetry: Entra ID returns different error responses depending on whether a supplied OAuth client ID is valid, allowing attackers to infer valid usernames and correct passwords at scale.

Attackers send HTTP POST requests to Microsoft’s OAuth 2.0 token endpoint using the Resource Owner Password Credentials (ROPC) flow, supplying a syntactically valid but spoofed client ID. The response contains an AADSTS error code that reveals account and password validity. Since no corresponding application name is recorded in sign-in logs, detections based on application-specific surges may miss the activity entirely.

Two large campaigns have adopted this technique: UNK_pyreq2323 (January–March 2026) used over 700,000 spoofed client IDs from AWS infrastructure to target more than 1 million accounts across nearly 4,000 tenants, causing lockouts for 28% of users. UNK_OutFlareAZ (starting December 2025) leveraged Cloudflare infrastructure to target over 2 million users with 3.7 million randomized spoofed application IDs. Both campaigns used valid UUIDs and precompiled username wordlists, but differed in client ID generation patterns.

Organizations are advised to monitor for authentication attempts with missing application names and implement Conditional Access policies that are not solely scoped to specific applications.