Back Feeds2.Feedburner

Fake OAuth client IDs are helping attackers slip past sign

Feeds2.Feedburner •Mirko Zorz • July 13, 2026

Attackers running account enumeration against Microsoft cloud tenants have added a step that keeps their probing out of the usual telemetry. They spoof the OAuth client ID, the globally unique identifier assigned to an application and passed as client_id in an authentication request. Microsoft Entra ID records that value as the application ID in its sign-in logs, and the way it handles unfamiliar identifiers opens a gap that operators have started to work through. Entra … More →

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

OAuth Client ID Spoofing Threatens Microsoft Entra Security Cybercriminals are increasingly using OAuth client ID spoofing to conduct account enumeration against Microsoft Entra, the identity management service. This method allows attackers to infer username and password validity without triggering alerts or generating successful sign-in events. Proofpoint has reported multiple campaigns utilizing this technique, with one campaign using over 3.7 million spoofed IDs to target more than two million users across nearly 4,000 organizations. The spoofed client IDs create blank entries in Entra's logs, making detection difficult for security teams. Attackers exploit the Resource Owner Password Credentials flow to submit credentials directly, bypassing traditional security measures like conditional access policies. The rise of this technique poses a significant risk to organizations relying on Microsoft Entra for identity management. 10 sources 70

Fake OAuth client IDs are helping attackers slip past sign

The full story

Extracted Entities

CWE Weaknesses (1)

Platforms (1)