TLDR Tech / InfoSec
OAuth Client ID Spoofing: Why Fake Client IDs Are Gaining Traction for Stealthy Enumeration
Attackers are abusing Microsoft Entra ID's differential AADSTS error responses, issuing ROPC-flow POST requests to /common/oauth2/token with spoofed or unregistered OAuth client IDs, to enumerate valid usernames and infer password validity via error codes like AADSTS50034, AADSTS50126, and AADSTS700016 without triggering a logged sign-in event or populating an application name for correlation. Proofpoint tracked two independent campaigns using this tradecraft at scale: UNK_pyreq2323 (January-March, AWS infrastructure, python-requests user agent, 700K+ spoofed IDs each reused across up to 12 users, targeting 1M+ accounts across ~4,000 tenants and triggering lockouts for 28% of targets) and the more evasive UNK_OutFlareAZ (December 2025-March 2026, Cloudflare infrastructure, spoofed Outlook user agent, fully randomized UUIDv4 per single-use attempt, targeting 2M+ users via alphabetically ordered common-surname wordlists). Defenders should flag Entra sign-in logs with a populated Application ID but blank Application Name as a spoofing indicator, treat AADSTS700016 responses as potential evidence of valid compromised credentials rather than mere failed logins, and note that Conditional Access policies scoped to specific applications won't catch traffic using spoofed client IDs.
Read the full story