Millions of Microsoft Entra Accounts Targeted in OAuth Client ID Spoofing Campaigns
Attackers spoof OAuth client IDs to probe Microsoft Entra accounts and test credentials.
Attackers are exploiting a vulnerability in Microsoft Entra ID by spoofing OAuth client IDs to test credentials and identify valid accounts. This technique bypasses common sign-in detection methods by submitting authentication requests with fake client IDs and analyzing error responses, which can reveal username validity and even successful credential combinations without a full sign-in. Proofpoint has observed multiple campaigns using this method against millions of accounts across thousands of tenants, indicating independent adoption by various threat actors.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers are abusing Microsoft Entra ID's OAuth authentication flow by submitting requests with spoofed client IDs, allowing them to enumerate valid usernames and test credentials without triggering standard sign-in alerts. Because the technique exploits how error responses differ between valid and invalid accounts, it effectively turns Microsoft's own authentication feedback against defenders. This matters because millions of accounts across thousands of tenants have already been targeted, and the method evades many traditional detection controls such as failed sign-in thresholds. The widespread independent adoption by multiple threat actors signals that this has become a reliable, low-friction credential harvesting technique.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Security monitoring (SIEM)
Logs from everywhere end up in one place, with alerts that someone actually sees.