OAuth Client ID Spoofing Exploits Blind Spot in Microsoft Entra ID to Validate Stolen Credentials
Proofpoint has uncovered a novel evasion technique called OAuth client ID spoofing, exploited by at least two threat actors to validate stolen…
Tag: UNK_pyreq2323
UNK_pyreq2323: OAuth Client ID Spoofing Campaign Targeting Microsoft Entra ID
UNK_pyreq2323 is a threat cluster that exploited OAuth client ID spoofing from January to March 2026, using over 700,000 spoofed client IDs…