OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials
Threat actors are exploiting a blind spot in Microsoft Entra ID’s sign-in telemetry by using ‘OAuth client ID spoofing’ to enumerate user accounts and validate stolen credentials without triggering traditional login alerts. Two distinct campaigns, UNK_pyreq2323 and UNK_OutFlareAZ, have been observed leveraging this technique, targeting over 1 million accounts across nearly 4,000 tenants and causing account lockouts for a significant portion of users. This tactic bypasses Conditional Access policies and traditional application-based detection methods.
A novel evasion technique, OAuth client ID spoofing, is being weaponized by threat actors to bypass security measures and gain unauthorized access to Microsoft Entra ID environments. This allows attackers to enumerate user accounts and validate stolen credentials without generating a successful sign-in event, which would normally alert defenders. The Entra sign-in logs are a primary telemetry source for identifying malicious authentication activity, including user enumeration, password spraying, and initial access attempts.
Threat clusters like UNK_pyreq2323 and UNK_OutFlareAZ have been observed exploiting this vulnerability. UNK_pyreq2323, active from January to March 2026, utilized over 700,000 spoofed client IDs from Amazon Web Services (AWS) infrastructure to target more than 1 million accounts across nearly 4,000 tenants, causing lockouts for roughly 28% of targeted users due to failed attempts. UNK_OutFlareAZ, starting in December 2025, leveraged Cloudflare infrastructure to target over 2 million users with 3.7 million randomized spoofed application IDs.
Both campaigns utilized valid UUIDs rather than malformed identifiers and demonstrated patterns aligned with precompiled username wordlists. However, they differed in how the client IDs were spoofed: UNK_pyreq2323 modified the trailing digits of a known application ID, reusing spoofed IDs across up to 12 users, while UNK_OutFlareAZ generated a unique client ID per request.
“By fragmenting authentication attempts across many fictional applications, activity becomes harder to correlate and may evade per-application detections and rate limiting,” stated Proofpoint. “Organizations may attempt to mitigate traditional enumeration attacks by applying Conditional Access policies scoped to applications commonly targeted for enumeration. Spoofed client IDs won’t trigger CA policies that are scoped to a specific application.”