Researchers at Proofpoint have documented a technique in which attackers forge the application identifiers in Microsoft Entra ID sign-in requests, letting them test usernames and passwords at scale while leaving little for defenders to detect.
The method, which Proofpoint calls OAuth client ID spoofing, exploits how Entra ID responds to login attempts. Every registered application carries a unique client ID, recorded in the sign-in logs that security teams rely on to spot attacks. Proofpoint found that when an attacker supplies a syntactically valid but unregistered client ID, Entra still processes the request and returns error codes that reveal whether the username exists and whether the password is correct, but logs no application name, leaving the field blank.
That gap defeats a common defense. Detections tuned to flag a surge of failed logins against a single application miss activity spread across thousands of fictitious application IDs, and Conditional Access policies scoped to specific applications never trigger, because the spoofed IDs match no real app. The technique lets an unauthenticated attacker enumerate accounts and confirm valid credentials without ever generating a successful sign-in event, so even a detected intrusion may leave defenders unaware that working passwords were exposed.
Proofpoint says it observed multiple large campaigns using the method, with distinct tooling suggesting several threat actors adopted it independently. One, tracked as UNK_pyreq2323, emerged in January and spread enumeration attempts across more than 700,000 spoofed client IDs, targeting over one million accounts across nearly 4,000 tenants; the volume of failed attempts locked out roughly 28 percent of targeted users. A larger campaign from Cloudflare infrastructure hit more than two million users using 3.7 million spoofed application IDs. To detect the activity, Proofpoint advises defenders to monitor sign-in logs for events with no application name.
The finding adds to pressure on Microsoft’s identity platform, which is itself in the middle of a security tightening, having recently set a mandatory timeline to move Entra ID users onto phishing-resistant passkeys. It also underscores why third parties keep building assurance layers on top of the platform, among them 1Kosmos, which joined the Entra Verified ID partner ecosystem for remote onboarding.
Password-based enumeration remains attractive because it needs no malware and no registered infrastructure, and the credentials it surfaces feed directly into account-takeover attempts that stronger authentication is meant to stop.
Sources: Proofpoint
–
By Ji-seo Kim
