TLDR Tech / InfoSec
OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials
Two threat groups abuse OAuth client ID spoofing in Microsoft Entra ID to test stolen usernames and passwords without generating successful sign‑in events in logs. They send ROPC flow requests with syntactically valid but fake client IDs, then read AADSTS error codes to confirm account and password validity. Campaigns from UNK_pyreq2323 and UNK_OutFlareAZ have already targeted millions of users across thousands of tenants using AWS and Cloudflare infrastructure.
Read the full story