[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6zqxszXo1sBP7IG93CXbQmXQUm5UaB_oTaD4ONOpmj8":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":26,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"6f985be7-6612-4b5b-bc3c-f41b1a315ec8","oauth-spoofing-bypasses-entra-id-sign-in-telemetry-to-validate-stolen-credentials","8392e619-ca36-4e60-b774-727f8235fefe","OAuth Spoofing Bypasses Entra ID Sign-In Telemetry to Validate Stolen Credentials","Attackers are exploiting a flaw in how Microsoft Entra ID processes OAuth client IDs, allowing them to submit spoofed identifiers during authentication requests to enumerate valid accounts and verify stolen credentials at scale. The critical danger is that these requests do not generate standard successful sign-in events, meaning most existing detection rules and alerting thresholds are completely blind to this activity. This highlights a systemic over-reliance on sign-in success\u002Ffailure logs as the primary signal for credential-based attacks. Defenders who assume that no alerts means no attack are left exposed when adversaries deliberately craft requests that fall outside normal telemetry pipelines. The scale of impact—millions of users across thousands of tenants—demonstrates how a single telemetry blind spot can be weaponized into a mass-exploitation campaign.","**Immediate actions:**\n- Audit Microsoft Entra ID diagnostic settings to ensure non-interactive and OAuth token request logs are fully captured and forwarded to your SIEM.\n- Enable and review Entra ID's 'NonInteractiveUserSignInLogs' and 'ServicePrincipalSignInLogs' tables for anomalous client ID patterns or high-volume enumeration behavior.\n- Force credential resets for any accounts flagged in threat intelligence feeds linked to UNK_pyreq2323 or UNK_OutFlareAZ campaigns.\n\n**Long-term improvements:**\n- Enforce phishing-resistant MFA (FIDO2\u002Fpasskeys) across all user accounts so that even validated credentials cannot be leveraged for account takeover.\n- Implement Conditional Access policies that restrict authentication attempts based on compliant device state, named locations, and trusted OAuth client IDs.\n- Adopt a Zero Trust posture by continuously validating identity context beyond initial sign-in, using Continuous Access Evaluation (CAE) in Entra ID.\n\n**Detection measures:**\n- Build SIEM detection rules that alert on high volumes of failed or unusual OAuth token requests originating from a single IP or ASN, even absent successful sign-in events.\n- Subscribe to Microsoft Entra ID threat intelligence and security advisories to receive timely guidance when new telemetry blind spots are identified.\n- Conduct regular purple-team exercises specifically testing credential enumeration techniques to validate that detection coverage extends beyond standard sign-in log analysis.",[12,13,14,15,16,17,18,19,20,21,22,23,24,25],"CIS Control 6: Access Control Management","CIS Control 8: Audit Log Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-7: Unsuccessful Logon Attempts","NIST SP 800-53 AU-2: Event Logging","NIST SP 800-53 AU-6: Audit Record Review and Reporting","NIST SP 800-53 IA-5: Authenticator Management","NIST SP 800-63B: Digital Identity Guidelines – Authentication Assurance","MITRE ATT&CK T1110: Brute Force – Password Spraying","MITRE ATT&CK T1087: Account Discovery","MITRE ATT&CK T1078: Valid Accounts","GDPR Article 32: Security of Processing (for EU tenants storing personal data)","ITIL: Event Management – ensuring telemetry completeness for incident detection",{},"published","2026-07-14T14:22:31.632403+00:00","2026-07-14T14:22:31.331+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Foauth-client-id-spoofing-lets-attackers.html","oauth-client-id-spoofing-lets-attackers-validate-stolen-microsoft-entra-credenti-5019a8","OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":42,"name":43,"slug":44,"description":45,"color":46},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",[],[49,53,57],{"slug":50,"name":51,"problem":52},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":54,"name":55,"problem":56},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":58,"name":59,"problem":60},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees."]