OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials
Proofpoint warns that threat actors are spoofing OAuth client IDs to enumerate accounts and validate stolen passwords in Microsoft Entra ID without generating detectable sign-in events.
Intelligence analysis by Llama
Researchers at Proofpoint have documented a novel evasion technique in which attackers supply syntactically valid but fake OAuth client IDs to Microsoft's token endpoint, allowing them to probe Entra ID credentials silently. Two independent campaigns, UNK_pyreq2323 and UNK_OutFlareAZ, have weaponized the gap at scale since late 2025.
Imagine a club where the bouncer usually writes down who tried to get in. Sneaky kids figured out they can pretend to be from fake groups that don't really exist, so the bouncer doesn't know which group to blame when they test lots of passwords. The bouncer still sees people trying the door, but can't tell which fake group sent them, making it really hard to catch the troublemakers.
Analysis
A Blind Spot in Entra ID Telemetry
Proofpoint researcher Rachel Rabin described Entra sign-in logs as a primary telemetry source for identifying malicious authentication activity, including user enumeration, password spraying, and initial access attempts. The OAuth client ID spoofing technique erodes that visibility by exploiting the different error responses Entra ID returns depending on whether a supplied client ID is valid. Because the application ID is recorded in the sign-in log without a corresponding application name, detections that look for surges against a specific application name may miss this activity entirely, as the field is blank. Even malformed client IDs that are not proper UUIDv4 values are not rejected outright, giving attackers additional latitude to probe credentials.
The net effect is that an attacker can iterate through stolen credential lists, inferring which accounts exist and which passwords are correct, all without ever producing a successful sign-in event that would typically alert a security team. That structural gap, according to Proofpoint, transforms Entra ID's authentication surface into a stealth validation oracle rather than a defensive checkpoint.
Two Campaigns, Same Tradecraft
Proofpoint said it has identified two large campaigns that independently adopted the technique toward the end of December 2025, indicating the approach is being increasingly incorporated into attacker tradecraft as opposed to being an isolated incident. UNK_pyreq2323, active from January to March 2026, used more than 700,000 spoofed client IDs from Amazon Web Services infrastructure to target more than 1 million accounts across nearly 4,000 tenants, causing lockouts for roughly 28% of targeted users due to failed attempts. UNK_OutFlareAZ, starting in December 2025, leveraged Cloudflare infrastructure to target over 2 million users with 3.7 million randomized spoofed application IDs.
The two clusters differ in interesting ways. UNK_pyreq2323 modified the trailing digits of a known application ID and reused spoofed IDs across up to 12 users, while UNK_OutFlareAZ generated a unique client ID per request and enumerated users alphabetically. Both used valid UUIDs rather than malformed identifiers and aligned with precompiled username wordlists. By fragmenting authentication attempts across many fictional applications, the activity becomes harder to correlate and may evade per-application detections and rate limiting, Proofpoint warned. Conditional Access policies scoped to commonly targeted applications are similarly bypassed, since spoofed client IDs simply do not match any defined application scope.
Broader Implications for Identity Providers
Although the problem of OAuth client ID spoofing is specific to Microsoft, Yaniv Miron, director of threat research at Proofpoint, told The Hacker News that other identity providers are possibly exposed to such issues. The general principle, that adversaries will attempt to spoof anything they can, has been a well-known method for years, and adversaries are constantly monitoring threat researchers' blogs and publications, meaning published research tends to accelerate adoption rather than deter it. This campaign, which builds on earlier tradecraft from clusters like UNK_CustomCloak that spoofed User-Agent strings to exploit the legacy Windows Live Custom Domains application, marks a meaningful evolution in how cloud identity attacks evade detection.
For defenders, the takeaway is that sign-in logs and per-application policies are no longer sufficient on their own. Organizations will need to look at the shape of authentication traffic itself: client ID reuse patterns, UUID distribution entropy, source infrastructure, and lockout ratios, rather than relying on the application name field to flag abuse. Microsoft has not yet announced a mitigation, leaving customers to compensate with behavioral analytics until the gap is closed at the platform level.
Key points
- Proofpoint identified two threat clusters, UNK_pyreq2323 and UNK_OutFlareAZ, weaponizing OAuth client ID spoofing against Microsoft Entra ID since late 2025.
- The technique uses syntactically valid but unregistered client IDs to enumerate accounts and validate passwords without generating successful sign-in events.
- UNK_pyreq2323 used over 700,000 spoofed client IDs from AWS to target more than 1 million accounts across nearly 4,000 tenants, causing 28% lockout rates.
- UNK_OutFlareAZ used 3.7 million randomized spoofed application IDs via Cloudflare infrastructure to target over 2 million users.
- Conditional Access policies scoped to specific applications do not trigger against spoofed client IDs, since the field is blank in sign-in logs.
- Proofpoint warned that other identity providers may be vulnerable to the same class of evasion.
Public disclosure by Proofpoint puts pressure on Microsoft to harden Entra ID's token endpoint, potentially closing the error-response gap and forcing attackers back to techniques that produce detectable sign-in events. Increased awareness may also push defenders toward behavioral detection, analyzing client ID entropy and source infrastructure patterns rather than relying on application name fields.
Because the technique produces no successful sign-in events and leaves the application name field blank, existing SIEM rules and Conditional Access policies scoped to applications may continue to miss these campaigns at scale. Adversaries are known to adopt public research quickly, so the window between disclosure and widespread weaponization may already be closing, and other identity providers may harbor the same flaw without yet knowing it.
