[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ftbk1nQ47OuBIDPSxgaUX2_Z1iQTILAj51b5gqLQ12Qs":3},{"article":4,"iocs":54,"watch_terms":70,"solutions":71,"lesson":165},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"8392e619-ca36-4e60-b774-727f8235fefe","OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials","oauth-client-id-spoofing-lets-attackers-validate-stolen-microsoft-entra-credenti-5019a8","At least two distinct threat actors are weaponizing a novel evasion technique called OAuth client ID spoofing in cloud campaigns, while slipping past telemetry. The activity allows users to enumerate user accounts and validate stolen credentials in Microsoft Entra ID environments, without ever generating a successful sign-in event that would otherwise alert defenders. And bad actors have begun","Two distinct threat actor groups are exploiting a novel OAuth client ID spoofing technique to enumerate user accounts and validate stolen credentials in Microsoft Entra ID environments while evading sign-in telemetry. By providing spoofed OAuth client IDs in authentication requests, attackers can infer valid usernames and passwords at scale without generating successful sign-in events that would alert defenders. The campaigns UNK_pyreq2323 and UNK_OutFlareAZ have targeted thousands of tenants, affecting millions of users since late 2025.","OAuth client ID spoofing lets attackers validate stolen Microsoft Entra credentials without detection.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Foauth-client-id-spoofing-lets-attackers.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjmB1bLC9cna7xlnvFdK0hUnsi8jeo6E7jMh20nj4XTvsF9ogpjbnlPCxx9QYQ1O2aS7JiSDQi4swIRNG6-Xjg2TGR4bn4Zn-KBkjsLTYcKUrXOD-rlGu4XYsvRx06eRqrT4duW0xwklKeYjZvRV1VSarJBKldBzN4DNhkWudVCGRdKPi9uVGrqEwL66mz5\u002Fs1600\u002FOAuth-ClientID.jpg","2026-07-14T11:21:35+00:00","2026-07-14T14:00:22.120699+00:00",9,[17,20,23,25,28,31],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"Microsoft Entra ID","product",{"name":24,"type":22},"Azure Active Directory",{"name":26,"type":27},"OAuth 2.0","technology",{"name":29,"type":30},"UNK_CustomCloak","threat_actor",{"name":32,"type":30},"UNK_pyreq2323","2c8f44d4-b56e-47cf-9677-04f22c9ee78d",{"id":33,"icon":35,"name":36,"slug":37},null,"Identity & Access","identity-access",[39,44,49],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":50},{"id":51,"icon":35,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,58,60,63,67],{"type":56,"value":29,"context":57},"malware","Threat cluster spoofing User-Agent strings and exploiting legacy Windows Live Custom Domains application for Microsoft Entra ID brute-force campaigns",{"type":56,"value":32,"context":59},"Campaign from January to March 2026 using 700,000+ spoofed client IDs from AWS infrastructure targeting 1M+ accounts across 4,000 tenants",{"type":56,"value":61,"context":62},"UNK_OutFlareAZ","Campaign starting December 2025 leveraging Cloudflare infrastructure to target 2M+ users with OAuth client ID spoofing",{"type":64,"value":65,"context":66},"mitre_attack","T1110.003","Password spraying attack technique used by threat actors",{"type":64,"value":68,"context":69},"T1087","Account enumeration via OAuth client ID spoofing to infer valid usernames",[18,21,24],{"controls":72,"vendors":155},[73,100,126],{"slug":74,"name":75,"problem":76,"products":77},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[78,86,92],{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":87,"vendor_name":18,"vendor_logo":88,"product_slug":89,"product_name":21,"url":90,"description":91},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":101,"name":102,"problem":103,"products":104},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[105,113,118],{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":87,"vendor_name":18,"vendor_logo":88,"product_slug":114,"product_name":115,"url":116,"description":117},"defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":127,"name":128,"problem":129,"products":130},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[131,139,147],{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xsiam","Cortex XSIAM","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xsiam","AI-driven security operations platform that centralises security data, detection, automation and response for the SOC.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-security-operations","Google Security Operations","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fsecurity-operations","Cloud SIEM and SOAR, formerly Chronicle.",{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":151,"product_name":152,"url":153,"description":154},"guardsix","Guardsix","\u002Fvendor-logos\u002Fguardsix.png","guardsix-siem","Guardsix SIEM","https:\u002F\u002Fguardsix.com\u002Fproduct\u002Fsiem","SIEM with automation, developed and hosted in Europe.",[156,159],{"slug":87,"name":18,"logo_path":88,"roles":157},[158],"affected",{"slug":160,"name":161,"logo_path":162,"roles":163},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png",[164],"reported_by",{"slug":166,"title":167,"body":168,"framework_refs":169,"framework_notes":184},"oauth-spoofing-bypasses-entra-id-sign-in-telemetry-to-validate-stolen-credentials","OAuth Spoofing Bypasses Entra ID Sign-In Telemetry to Validate Stolen Credentials","Attackers are exploiting a flaw in how Microsoft Entra ID processes OAuth client IDs, allowing them to submit spoofed identifiers during authentication requests to enumerate valid accounts and verify stolen credentials at scale. The critical danger is that these requests do not generate standard successful sign-in events, meaning most existing detection rules and alerting thresholds are completely blind to this activity. This highlights a systemic over-reliance on sign-in success\u002Ffailure logs as the primary signal for credential-based attacks. Defenders who assume that no alerts means no attack are left exposed when adversaries deliberately craft requests that fall outside normal telemetry pipelines. The scale of impact—millions of users across thousands of tenants—demonstrates how a single telemetry blind spot can be weaponized into a mass-exploitation campaign.",[170,171,172,173,174,175,176,177,178,179,180,181,182,183],"CIS Control 6: Access Control Management","CIS Control 8: Audit Log Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-7: Unsuccessful Logon Attempts","NIST SP 800-53 AU-2: Event Logging","NIST SP 800-53 AU-6: Audit Record Review and Reporting","NIST SP 800-53 IA-5: Authenticator Management","NIST SP 800-63B: Digital Identity Guidelines – Authentication Assurance","MITRE ATT&CK T1110: Brute Force – Password Spraying","MITRE ATT&CK T1087: Account Discovery","MITRE ATT&CK T1078: Valid Accounts","GDPR Article 32: Security of Processing (for EU tenants storing personal data)","ITIL: Event Management – ensuring telemetry completeness for incident detection",{}]