OAuth Client ID Spoofing Attacks Threaten Microsoft Entra ID Users

Microsoft Entra ID users are vulnerable to OAuth client ID spoofing attacks, which can lead to account takeover. Attackers use the OAuth 2.0 Resource Owner Password Credentials (ROPC) flow to exploit a common misconfiguration in legacy scripts and third-party integrations.

The attack works by using a fabricated or rotating client ID, making it difficult for security teams to detect. The attackers are exploiting a field that is not being watched for cardinality, which means the number of unique client IDs is not being tracked.

Proofpoint researchers have identified two campaigns, UNK_pyreq2323 and UNK_OutFlareAZ, which targeted over 1 million users across 4,000 tenants. The attacks were successful in getting a 28% lockout rate, indicating that the attackers had validated credentials and could use them for further malicious activities.

To detect this type of attack, security teams need to build a detection logic that correlates client ID cardinality, missing application names, and AADSTS error sequences across a time window. This requires a rehearsed response runbook, including resetting, revoking, and reviewing sign-in and mailbox-access activity for the affected accounts.