[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fpzXI7OxDspMgFKhc1ZLnN0M3cPI83OqjmgXQtMDhDcg":3},{"article":4,"iocs":54,"watch_terms":55,"solutions":56,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"e84cbe87-c8b9-49fe-8be1-2f94fa8d0720","Millions of Microsoft Entra Accounts Targeted in OAuth Client ID Spoofing Campaigns","millions-of-microsoft-entra-accounts-targeted-in-oauth-client-id-spoofing-campai-bc97a7","Proofpoint details how attackers spoof OAuth client IDs to probe Microsoft Entra accounts, test credentials and bypass common sign-in detections at cloud scale.","Attackers are exploiting a vulnerability in Microsoft Entra ID by spoofing OAuth client IDs to test credentials and identify valid accounts. This technique bypasses common sign-in detection methods by submitting authentication requests with fake client IDs and analyzing error responses, which can reveal username validity and even successful credential combinations without a full sign-in. Proofpoint has observed multiple campaigns using this method against millions of accounts across thousands of tenants, indicating independent adoption by various threat actors.","Attackers spoof OAuth client IDs to probe Microsoft Entra accounts and test credentials.","https:\u002F\u002Fhackread.com\u002Fmicrosoft-entra-accounts-oauth-client-id-spoofing\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F07\u002Fmicrosoft-entra-accounts-oauth-client-id-spoofing.png","2026-07-14T09:30:30+00:00","2026-07-14T10:00:17.228518+00:00",8,[17,20,23,25,28,31],{"name":18,"type":19},"Microsoft Entra ID","product",{"name":21,"type":22},"Microsoft","vendor",{"name":24,"type":22},"Proofpoint",{"name":26,"type":27},"OAuth","technology",{"name":29,"type":30},"UNK_pyreq2323","campaign",{"name":32,"type":30},"UNK_OutFlareAZ","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":33,"icon":35,"name":36,"slug":37},null,"Threat Intelligence","threat-intelligence",[39,44,49],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":50},{"id":51,"icon":35,"name":52,"slug":53},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",[],[21,24,18],{"controls":57,"vendors":141},[58,87,115],{"slug":59,"name":60,"problem":61,"products":62},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":88,"name":89,"problem":90,"products":91},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[92,100,108],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":109,"vendor_name":21,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":116,"name":117,"problem":118,"products":119},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[120,125,133],{"vendor_slug":109,"vendor_name":21,"vendor_logo":110,"product_slug":121,"product_name":122,"url":123,"description":124},"sentinel","Microsoft Sentinel","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-sentinel-siem","Cloud SIEM and automated response, built on Azure.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"vega","Vega","\u002Fvendor-logos\u002Fvega.png","vega-agentic-detection","Agentic Detection","https:\u002F\u002Fvega.io\u002Fplatform\u002Fagentic-detection","Detection rules that run across security data in the stores where it already lives, so logs do not have to be moved into a central SIEM first.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"abstract-security","Abstract Security","\u002Fvendor-logos\u002Fabstract-security.png","abstract-composable-siem","Abstract Composable SIEM","https:\u002F\u002Fwww.abstract.security\u002Fplatform","SIEM built from separate parts for collection, AI-assisted detection and tiered retention, which can be adopted one at a time.",[142,145],{"slug":109,"name":21,"logo_path":110,"roles":143},[144],"affected",{"slug":146,"name":24,"logo_path":147,"roles":148},"proofpoint","\u002Fvendor-logos\u002Fproofpoint.png",[149],"reported_by",{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":167},"oauth-client-id-spoofing-bypasses-entra-id-sign-in-detection-at-scale","OAuth Client ID Spoofing Bypasses Entra ID Sign-In Detection at Scale","Attackers are abusing Microsoft Entra ID's OAuth authentication flow by submitting requests with spoofed client IDs, allowing them to enumerate valid usernames and test credentials without triggering standard sign-in alerts. Because the technique exploits how error responses differ between valid and invalid accounts, it effectively turns Microsoft's own authentication feedback against defenders. This matters because millions of accounts across thousands of tenants have already been targeted, and the method evades many traditional detection controls such as failed sign-in thresholds. The widespread independent adoption by multiple threat actors signals that this has become a reliable, low-friction credential harvesting technique.",[155,156,157,158,159,160,161,162,163,164,165,166],"CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","CIS Control 8 – Audit Log Management","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 AC-17 (Remote Access)","NIST SP 800-53 IA-5 (Authenticator Management)","NIST SP 800-53 AU-6 (Audit Review, Analysis, and Reporting)","NIST SP 800-207 (Zero Trust Architecture)","MITRE ATT&CK T1586.003 – Compromise Accounts: Cloud Accounts","MITRE ATT&CK T1078.004 – Valid Accounts: Cloud Accounts","GDPR Article 32 – Security of Processing","OAuth 2.0 Security Best Current Practice (RFC 9700)",{}]