Threat actors are increasingly exploiting spoofed OAuth client IDs to enumerate Microsoft Entra ID accounts and identify potentially valid credentials while evading traditional detection methods, according to recent research from Proofpoint.
OAuth client IDs are globally unique identifiers assigned to registered applications. During authentication, an application submits its identifier through the client_id parameter.
Microsoft Entra ID typically logs this information in sign-in records, including the application name when the ID belongs to a legitimate registered app.
However, attackers can submit fabricated client IDs during authentication requests. Entra ID provides different error messages depending on whether the username, password, and application identifier are valid.
Spoofed OAuth Client IDs Expose
This allows attackers to determine whether an account exists and whether the provided credentials are correct. Proofpoint tested this technique using Microsoft’s OAuth token endpoint and the Resource Owner Password Credentials flow.
A non-existent username generates the AADSTS50034 error, while a valid username paired with an incorrect password returns AADSTS50126.
If attackers use a valid username and password with an unregistered or spoofed application ID, Entra ID may return the AADSTS700016 error, indicating that the application identifier is not recognized.
This response is particularly significant because it can reveal valid username-password pairs without triggering a successful sign-in event.
Consequently, attackers can identify compromised credentials while security teams only see what appears to be failed authentication attempts.
Additionally, this technique undermines detection efforts based on application names. When a syntactically valid but unregistered client ID is supplied, Entra ID may log the application ID without an associated application name.
If the ID is malformed, both the application ID and application name fields may be empty. Security tools that monitor for unusual authentication volumes against known applications could fail to correlate this activity effectively.
Proofpoint identified two major campaigns utilizing this approach. The first, tracked as UNK_pyreq2323, occurred in January 2026 and targeted over 111 million accounts across nearly 4,000 Entra ID tenants.
This campaign employed over 700,000 spoofed client IDs and reportedly caused account lockouts for approximately 28% of the targeted users.
The second campaign, tracked as UNK_OutFlareAZ, began in December 2025 and operated at a significantly larger scale. It targeted more than 222 million users and utilized 3.7 million spoofed client IDs.
This activity primarily originated from Cloudflare infrastructure and employed a forged Microsoft Outlook user agent.
Unlike the first campaign, which modified the trailing digits of an Exchange Online application ID, UNK_OutFlareAZ generated a new random UUIDv4 client ID for each authentication request.
This reduced the reuse of identifiers and made correlation more challenging. Proofpoint researchers also noted that this campaign tested common usernames, such as dsmith, msmith, and jbrown, across multiple tenants.
Proofpoint indicated that the distinct user agents, infrastructure, and ID-generation techniques suggest that multiple threat actors have independently adopted OAuth client ID spoofing.
Organizations are advised to review Entra ID sign-in logs for authentication events that are missing application names or contain blank application IDs.
Defenders should also investigate AADSTS700016 errors, as these may indicate that attackers supplied valid credentials alongside a fake OAuth application ID rather than merely encountering a configuration issue with the application.
Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.
The post Hackers Spoof 3.7 Million OAuth Client IDs to Stealthily Enumerate 2 Million Entra ID Users appeared first on Cyber Security News.