Back Feeds.4Sysops

OAuth client ID spoofing allows stealthy Microsoft Entra account enumeration

Feeds.4Sysops •IT News • July 13, 2026

Attackers are exploiting a novel technique called OAuth client ID spoofing to bypass traditional detection mechanisms in Microsoft Entra ID. By sending authentication requests with fabricated or random client identifiers, threat actors can perform account enumeration and password validation without triggering standard alerts. This method utilizes the Resource Owner Password Credentials flow to submit credentials directly to the Microsoft identity platform. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

OAuth Client ID Spoofing Threatens Microsoft Entra Security Cybercriminals are increasingly using OAuth client ID spoofing to conduct account enumeration against Microsoft Entra, the identity management service. This method allows attackers to infer username and password validity without triggering alerts or generating successful sign-in events. Proofpoint has reported multiple campaigns utilizing this technique, with one campaign using over 3.7 million spoofed IDs to target more than two million users across nearly 4,000 organizations. The spoofed client IDs create blank entries in Entra's logs, making detection difficult for security teams. Attackers exploit the Resource Owner Password Credentials flow to submit credentials directly, bypassing traditional security measures like conditional access policies. The rise of this technique poses a significant risk to organizations relying on Microsoft Entra for identity management. 12 sources 70

OAuth client ID spoofing allows stealthy Microsoft Entra account enumeration

The full story

Extracted Entities

Attack Types (1)

Platforms (2)