OAuth Client ID Spoofing: A Stealthy Threat to Microsoft Entra ID Environments
The world of cybersecurity is constantly evolving, and threat actors are always finding new ways to exploit vulnerabilities. One such technique, OAuth client ID spoofing, has been making waves in the cloud security space. This innovative evasion method allows attackers to validate stolen Microsoft Entra credentials without triggering sign-in alerts, posing a significant challenge to defenders.
The Power of OAuth Client IDs
OAuth client IDs, or GUIDs, are unique identifiers assigned to applications when requesting access to user data. These IDs are crucial in authentication requests, and attackers have found a way to manipulate them for their benefit. By providing spoofed client IDs, attackers can enumerate user accounts and infer password validity without generating successful sign-in events, making it a stealthy and effective attack vector.
Exploiting Telemetry Gaps
The key to this attack lies in the way Microsoft Entra ID handles error responses. When a spoofed client ID is used, the system returns different error responses depending on its validity. Attackers can analyze these responses to identify valid accounts and passwords, even if the client ID is malformed. This blind spot in telemetry allows them to bypass standard sign-in restrictions and probe user credentials.
A Growing Threat
What makes this attack even more concerning is its increasing prevalence. Proofpoint, a cybersecurity firm, has identified two large campaigns that adopted this technique towards the end of 2025. These campaigns, UNKpyreq2323 and UNKOutFlareAZ, targeted millions of accounts across thousands of tenants, causing lockouts for a significant portion of targeted users.
Techniques and Patterns
UNKpyreq2323 modified known application IDs and reused spoofed IDs across multiple users, while UNKOutFlareAZ generated unique client IDs per request. These approaches demonstrate a strategic use of authentication attempts, making it harder to correlate and detect. The attackers also employed valid UUIDs and precompiled username wordlists, adding another layer of complexity.
Evading Detection
The impact of this attack goes beyond the immediate breach. Attackers can identify accounts for stealthy access, making it challenging for defenders to identify suspicious activity. Traditional enumeration attacks can be mitigated by Conditional Access policies, but spoofed client IDs won't trigger these policies, allowing attackers to evade detection.
A Call to Action
This emerging threat highlights the need for organizations to stay vigilant and adapt their security measures. As attackers continue to evolve their tactics, it is crucial to monitor and analyze authentication logs, identify anomalies, and implement robust security policies. By staying one step ahead, we can protect our cloud environments from this stealthy and sophisticated attack vector.
In my opinion, the OAuth client ID spoofing technique showcases the creativity and determination of threat actors. It serves as a reminder that cybersecurity is an ongoing battle, and we must continuously enhance our defenses to safeguard sensitive data and systems.
