OAuth client ID spoofing lets attackers validate stolen Entra credentials
Proofpoint found two campaigns submitting forged OAuth client IDs to Entra's token endpoint. Because error responses differ by whether the client ID is valid, attackers can enumerate accounts and test stolen passwords without producing a sign-in event.
Proofpoint researchers, including analyst Rachel Rabin, identified two large independent campaigns adopting a technique they call OAuth client ID spoofing, beginning in late December 2025.
The mechanics are simple. An OAuth client ID is a GUID identifying an application requesting access. Attackers POST forged client IDs to Microsoft's OAuth 2.0 token endpoint, and Entra ID returns different errors depending on whether the client ID is valid. That difference is an oracle: it reveals whether an account exists and whether a password is correct, all without a successful sign-in.
The telemetry consequence is the point. Because no successful sign-in occurs, the activity sidesteps detections built on sign-in events. Worse, when a spoofed client ID is used, Entra sign-in logs record an application ID with the application name field left blank, so any rule keyed on application name simply does not fire.
Why it matters
This is a validation technique, not an access technique, and that is precisely why it deserves attention: it is what an attacker does with a dump before they use it. A campaign can confirm which of a million stolen passwords still work, quietly, then spend only verified credentials on the noisy part.
Two practical consequences. If your password spraying detections depend on failed or successful sign-in volume, test whether they see this at all. And check your Conditional Access scoping, because the researchers note that policies scoped to specific applications will not trigger on a spoofed client ID. A blank application name in Entra sign-in logs is worth alerting on by itself.
Source: The Hacker News
Related on Start with Identity
- BlogCisco FMC shipped with hardcoded credentials, and attackers found them before the patch did
CVE-2026-20316 is a low-privileged account with credentials hardcoded into Cisco Secure Firewall Management Center, giving unauthenticated remote attackers acce
- BlogOne actor signed in as Entra ID apps with stolen secrets and reached 27 organizations, Todyl says
Todyl is tracking an ongoing campaign in which one operator uses stolen client secrets to sign in to Microsoft Entra ID as app registrations, reaching 27 organi
- BlogShinyHunters claims an Ernst & Young breach that started with someone else's stolen credentials
The extortion group says it used credentials obtained through a supply-chain attack, source undisclosed, to reach EY's Jira, GitHub, and Azure environments, and
- CVECheck Point Remote Access VPN lets attackers in without a password over IKEv1
A certificate validation logic flaw in Check Point Remote Access and Mobile Access over deprecated IKEv1 let attackers open a VPN session without a valid passwo
- GlossaryClient Credentials Grant
An OAuth 2.0 flow where an application authenticates as itself, with no user present, to obtain an access token. The standard pattern for machine-to-machine acc
- CVEmacOS Screen Sharing lets a network attacker in without credentials
A state-management bug in macOS Screen Sharing let an attacker on the network authenticate without a valid password and take remote control of the Mac. Apple fi