Proofpoint Uncovers Large-Scale OAuth Client ID Spoofing Campaigns Targeting Millions of Microsoft Entra Accounts

Miao Zhang
2 days ago
6 min read

Cloud identity has become the foundation of modern enterprise security. As organizations migrate applications, users, and business processes to cloud platforms, identity providers such as Microsoft Entra ID have evolved into the primary gatekeepers for authentication, authorization, and access management. This shift has dramatically improved scalability and centralized security, but it has also transformed identity systems into high-value targets for cybercriminals.

Recent research has highlighted an emerging attack technique known as OAuth client ID spoofing, demonstrating how attackers can exploit authentication behavior to validate usernames and even confirm stolen credentials without producing the successful sign-in events that defenders typically monitor. Rather than exploiting a software vulnerability, this approach leverages expected authentication workflows and subtle differences in error handling to create a dangerous visibility gap.

The discovery illustrates an important reality in modern cybersecurity. Attackers increasingly succeed not by breaking encryption or compromising authentication protocols directly, but by exploiting operational assumptions, logging limitations, and implementation details that were never intended to become security signals.

Why Identity Has Become the Primary Attack Surface

Traditional enterprise security focused heavily on protecting network perimeters. Firewalls, intrusion prevention systems, and endpoint defenses formed multiple protective layers around corporate infrastructure.

Cloud computing fundamentally changed that architecture.

Applications now operate across multiple environments, employees work remotely, and services authenticate users from virtually anywhere. In this environment, identity has effectively become the new perimeter.

Every authentication request represents an opportunity for either legitimate access or malicious reconnaissance.

As a result, attackers increasingly target:

User credentials
Authentication workflows
Identity providers
Multi-factor authentication processes
OAuth implementations
Cloud administration portals

Instead of attacking infrastructure directly, adversaries often attempt to compromise trusted identities that already possess legitimate access.

Understanding OAuth Client IDs

OAuth enables applications to securely request access to protected resources on behalf of users.

Each registered application receives a unique client identifier, commonly referred to as a client ID.

The client ID serves several purposes:

Identifies the requesting application
Enables authorization workflows
Associates authentication requests with registered software
Supports logging and auditing
Allows administrators to apply application-specific security policies

Importantly, the client ID itself is not a secret. It functions as a public identifier that helps authentication systems recognize which application initiated a request.

The newly observed attack technique exploits how Microsoft Entra ID processes these identifiers during authentication.

How OAuth Client ID Spoofing Works

The reported technique centers on Microsoft's OAuth token endpoint under the Resource Owner Password Credentials (ROPC) flow.

Instead of registering a legitimate OAuth application, attackers submit authentication requests using fabricated client identifiers.

These identifiers may either:

Follow the proper UUID format without corresponding to any registered application
Contain malformed values that still trigger informative authentication responses

Rather than immediately rejecting the request before credential evaluation, the authentication process may continue far enough to generate different Azure Active Directory Security Token Service (AADSTS) error codes.

Those error codes reveal valuable information.

Depending on the response, attackers can determine:

Authentication Response	Potential Information Revealed
Invalid username	Account likely does not exist
Incorrect password	Username exists
Application not recognized after credential validation	Username and password may both be valid
Missing application metadata	Possible spoofed client ID usage

Although no successful authentication occurs, attackers receive enough information to validate accounts and prioritize future compromise attempts.

Why This Technique Is Difficult to Detect

Modern security monitoring relies heavily on telemetry.

Security teams often investigate:

Successful logins
Failed authentication spikes
Password spraying
Impossible travel
High-risk applications
Suspicious OAuth clients

OAuth client ID spoofing weakens several of these assumptions.

When fabricated client identifiers are used, Entra may record incomplete application metadata.

Examples include:

Missing application names
Blank application fields
Unknown application identifiers
Large numbers of unique fictional client IDs

Since many security detections group authentication activity by application, distributing requests across thousands or millions of fabricated client IDs makes correlation substantially more difficult.

This transforms ordinary failed authentication traffic into a much more complex investigation.

Large-Scale Campaigns Demonstrate Operational Adoption

The research identified at least two independent campaigns using this technique at significant scale, suggesting that OAuth client ID spoofing is becoming part of mainstream attacker tradecraft rather than remaining an isolated experiment.

The campaigns demonstrated distinct operational characteristics.

UNK_pyreq2323

Researchers observed activity associated with:

More than 700,000 spoofed client IDs
Over one million targeted accounts
Nearly 4,000 Microsoft Entra tenants
Amazon Web Services infrastructure
Python Requests user agent
Approximately 28% of targeted users experiencing account lockouts

Instead of generating completely random identifiers, this campaign modified the trailing digits of a known Exchange Online application identifier while limiting reuse of individual spoofed IDs.

UNK_OutFlareAZ

A second operation operated on even greater scale.

Characteristics included:

More than two million targeted users
Approximately 3.7 million spoofed client identifiers
Cloudflare infrastructure
Microsoft Office user agent
Random UUID generation for every authentication request

Unlike the earlier campaign, every authentication attempt received its own fabricated client identifier, making detection through application correlation considerably more challenging.

The operational differences strongly suggest independent adoption rather than activity from a single threat actor.

Credential Validation Without Successful Logins

Perhaps the most concerning aspect of OAuth client ID spoofing is that attackers may validate credentials without obtaining an access token.

This distinction is important.

Organizations often assume that failed authentication attempts represent unsuccessful attacks.

In this scenario, however, attackers may already know:

Which accounts exist
Which passwords remain valid
Which credentials should be targeted later
Which users deserve additional phishing efforts

The failed login itself becomes less significant than the intelligence collected during the authentication process.

This reconnaissance can support future operations involving:

Credential stuffing
Targeted phishing
Multi-factor authentication fatigue attacks
Business email compromise
Privilege escalation
Cloud account takeover

Why Conditional Access May Offer Limited Protection

Many organizations rely on Microsoft Entra Conditional Access policies to strengthen authentication security.

These policies frequently apply restrictions based upon:

Applications
User groups
Device compliance
Geographic location
Risk level
Authentication strength

OAuth client ID spoofing introduces an unexpected complication.

If authentication requests use fabricated application identifiers rather than legitimate applications, policies specifically targeting recognized applications may not activate as defenders expect.

Although Conditional Access remains an essential security control, this technique illustrates that application-based assumptions deserve careful evaluation.

Detection Strategies for Security Teams

Organizations should expand authentication monitoring beyond traditional success and failure metrics.

Potential indicators include:

Authentication Anomalies

Missing application names
Blank application identifiers
Unexpected AADSTS700016 responses
Large authentication volumes using unknown applications

Behavioral Indicators

High numbers of authentication attempts across many fictional client IDs
Distributed password spraying
Sequential username enumeration
Generic username patterns across multiple tenants

Infrastructure Correlation

Requests originating from shared cloud infrastructure should receive additional scrutiny when combined with unusual authentication behavior.

Rather than viewing application-not-found errors purely as configuration problems, security analysts should evaluate whether they may indicate credential validation attempts.

Business Implications for Enterprise Security

OAuth client ID spoofing demonstrates that identity security increasingly depends on understanding authentication context rather than merely recording authentication outcomes.

Organizations should recognize several strategic lessons.

Security Lesson	Business Impact
Authentication telemetry has blind spots	Expand monitoring capabilities
Identity attacks evolve rapidly	Continuously update detection logic
Cloud-native attacks exploit expected behavior	Monitor workflows, not only failures
Application metadata matters	Improve log analysis
Reconnaissance often precedes compromise	Investigate unusual failed authentication activity

These lessons extend beyond Microsoft Entra environments and reflect broader challenges facing cloud identity security.

Looking Ahead

Identity providers continually improve authentication protocols, telemetry, and defensive capabilities. Likewise, attackers continuously adapt their techniques in response to those improvements.

Future identity attacks are likely to focus less on breaking authentication technologies and more on exploiting operational characteristics such as:

Logging behavior
Error handling
API workflows
Authentication sequencing
Identity federation
Cloud application integration

Organizations that treat authentication telemetry as a strategic intelligence source rather than merely an operational log will be better positioned to detect emerging attack techniques.

Conclusion

OAuth client ID spoofing highlights how modern cyberattacks increasingly exploit implementation details rather than software vulnerabilities. By leveraging differences in Microsoft Entra ID authentication responses, attackers can enumerate users, validate credentials, and prepare future compromise attempts while avoiding many traditional detection mechanisms based on successful sign-ins.

The observed campaigns demonstrate that this is no longer a theoretical technique. Its adoption across large-scale operations indicates that identity reconnaissance is becoming more sophisticated, automated, and cloud-focused. Security teams must therefore expand monitoring beyond conventional login success metrics and examine anomalies in application metadata, authentication error codes, and behavioral patterns that may reveal stealthier forms of credential validation.

As enterprise identity systems continue evolving, visibility into authentication workflows will become just as important as strong authentication itself. Organizations that strengthen telemetry analysis, continuously refine detection strategies, and understand the subtle behaviors of cloud identity platforms will be better prepared for the next generation of identity-based attacks.

For readers interested in cybersecurity, identity protection, and emerging AI-driven security challenges, the expert team at 1950.ai, including insights shared by Dr. Shahid Masood, continues to examine how evolving authentication technologies, cloud security, and advanced threat intelligence are shaping the future of digital trust.