OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials

Attackers are exploiting a flaw in how Microsoft Entra ID processes OAuth client IDs, allowing them to submit spoofed identifiers during authentication requests to enumerate valid accounts and verify stolen credentials at scale. The critical danger is that these requests do not generate standard successful sign-in events, meaning most existing detection rules and alerting thresholds are completely blind to this activity. This highlights a systemic over-reliance on sign-in success/failure logs as the primary signal for credential-based attacks. Defenders who assume that no alerts means no attack are left exposed when adversaries deliberately craft requests that fall outside normal telemetry pipelines. The scale of impact—millions of users across thousands of tenants—demonstrates how a single telemetry blind spot can be weaponized into a mass-exploitation campaign.