[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7m_nORCjs35IhdQ3r3DuuYvCw_IS8MdaQylWmgKV5Oc":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":45,"controls":46},"7a4bb12b-b7bc-4914-93ad-550ac2f5f6cc","oauth-client-id-spoofing-bypasses-entra-id-sign-in-detection-at-scale","e84cbe87-c8b9-49fe-8be1-2f94fa8d0720","OAuth Client ID Spoofing Bypasses Entra ID Sign-In Detection at Scale","Attackers are abusing Microsoft Entra ID's OAuth authentication flow by submitting requests with spoofed client IDs, allowing them to enumerate valid usernames and test credentials without triggering standard sign-in alerts. Because the technique exploits how error responses differ between valid and invalid accounts, it effectively turns Microsoft's own authentication feedback against defenders. This matters because millions of accounts across thousands of tenants have already been targeted, and the method evades many traditional detection controls such as failed sign-in thresholds. The widespread independent adoption by multiple threat actors signals that this has become a reliable, low-friction credential harvesting technique.","**Immediate actions:**\n- Enable Microsoft Entra ID's Conditional Access policies to restrict authentication attempts from untrusted locations, devices, and unknown client applications.\n- Audit OAuth application registrations and enforce strict allowlisting of approved client IDs within your tenant.\n- Enable and review Entra ID sign-in logs and risky sign-in alerts for anomalous OAuth client ID patterns.\n\n**Long-term improvements:**\n- Enforce phishing-resistant MFA (e.g., FIDO2\u002Fpasskeys) across all accounts to reduce the value of successfully harvested credentials.\n- Implement a zero-trust identity strategy that continuously evaluates authentication context rather than relying solely on password correctness.\n- Establish a regular OAuth application review process to detect unauthorized or suspicious client registrations.\n\n**Detection measures:**\n- Integrate Entra ID sign-in logs with your SIEM and create alerts for high volumes of authentication errors tied to unrecognized or unknown client IDs.\n- Deploy a threat intelligence feed to correlate known malicious OAuth client IDs and IP ranges against your authentication telemetry.\n- Configure User and Entity Behavior Analytics (UEBA) to baseline normal OAuth usage patterns and flag deviations at scale.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","CIS Control 8 – Audit Log Management","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 AC-17 (Remote Access)","NIST SP 800-53 IA-5 (Authenticator Management)","NIST SP 800-53 AU-6 (Audit Review, Analysis, and Reporting)","NIST SP 800-207 (Zero Trust Architecture)","MITRE ATT&CK T1586.003 – Compromise Accounts: Cloud Accounts","MITRE ATT&CK T1078.004 – Valid Accounts: Cloud Accounts","GDPR Article 32 – Security of Processing","OAuth 2.0 Security Best Current Practice (RFC 9700)",{},"published","2026-07-14T10:20:35.839993+00:00","2026-07-14T10:20:35.752+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fhackread.com\u002Fmicrosoft-entra-accounts-oauth-client-id-spoofing\u002F","millions-of-microsoft-entra-accounts-targeted-in-oauth-client-id-spoofing-campai-bc97a7","Millions of Microsoft Entra Accounts Targeted in OAuth Client ID Spoofing Campaigns",[33,39],{"id":34,"name":35,"slug":36,"description":37,"color":38},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":40,"name":41,"slug":42,"description":43,"color":44},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",[],[47,51,55],{"slug":48,"name":49,"problem":50},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":52,"name":53,"problem":54},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":56,"name":57,"problem":58},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees."]