UNK_pyreq2323 is a threat cluster that exploited OAuth client ID spoofing from January to March 2026, using over 700,000 spoofed client IDs from AWS infrastructure to target more than 1 million accounts across nearly 4,000 tenants, causing lockouts for 28% of users.