OAuth Client ID Spoofing Enables Entra ID Enumeration Without Successful Sign-Ins
Summary
Proofpoint says attackers used spoofed OAuth client IDs to enumerate Microsoft Entra ID accounts and infer credential validity without successful sign-ins. One campaign targeted over 1 million accounts; another targeted over 2 million users. Blank app fields and AADSTS7
Key points
- Proofpoint simulated requests to Entra ID’s OAuth token endpoint using the Resource Owner Password Credentials flow and found that responses and sign-in log fields can reveal account and password validity.
- The article reports that AADSTS50034 indicates an invalid username, AADSTS50126 a valid username with an invalid password, and AADSTS700016 a valid username and password paired with an unrecognized application ID.
- Spoofed client IDs can leave the application name blank in sign-in logs, potentially evading detections or Conditional Access policies scoped to specific applications.
- Proofpoint says campaign UNK_pyreq2323 used over 700,000 spoofed IDs and targeted over 1 million accounts across nearly 4,000 tenants; approximately 28% of targeted users experienced account lockouts.
- Proofpoint reports that UNK_OutFlareAZ targeted over 2 million users with 3.7 million spoofed application IDs, using randomized UUIDv4 identifiers and infrastructure primarily from Cloudflare.
- The campaigns used different client ID generation and enumeration patterns, which Proofpoint says suggest distinct tools or operators adopting the same technique.
- Proofpoint recommends monitoring sign-in records with blank application names or missing application IDs. AADSTS700016 may indicate valid credentials were identified, but is not proof of account compromise.
Article Details
- Attack Vectors
- Attackers sent POST requests to Microsoft Entra ID’s /common/oauth2/token endpoint using the Resource Owner Password Credentials flow and spoofed OAuth client IDs.
- Campaigns interpreted AADSTS responses to determine whether usernames and passwords were valid, without generating successful sign-ins.
- UNK_pyreq2323 randomized the trailing digits of an Exchange Online client ID and used AWS infrastructure; UNK_OutFlareAZ generated a unique UUIDv4 client ID per request and originated primarily from Cloudflare infrastructure.
- Defensive Notes
- Monitor sign-in logs for entries with a blank application name or missing application ID, which Proofpoint identifies as possible indicators of client ID spoofing.
- Treat AADSTS700016 responses as potentially indicating valid credentials, not only failed login attempts.
- Application-scoped Conditional Access policies may not trigger for spoofed client IDs.
MITRE ATT&CK
T1087.004 · Cloud AccountThe campaigns enumerated Microsoft Entra ID accounts by interpreting authentication error responses, without successful sign-ins.T1110.001 · Password GuessingAttackers submitted username and password combinations to the OAuth token endpoint and used AADSTS responses to identify invalid passwords and valid credential pairs.
Vendors
Amazon Web ServicesUNK_pyreq2323 used Python requests from AWS infrastructure and spoofed more than 700,000 client IDs while targeting over 1 million users.CloudflareDiscovery – Attackers leveraged cloud authentication behavior in Microsoft Entra ID and used AWS/Cloudflare-hosted infrastructure to conduct large-scale campaigns (‘originated from AWS infrastructure’ /MicrosoftProofpoint found that attackers are abusing OAuth client ID spoofing in Microsoft Entra ID to enumerate accounts and validate credentials without creating successful sign-in events.
Products
Exchange OnlineThe method for spoofing client IDs was unsophisticated, using the prefix for the application “Exchange Online”.Microsoft Entra IDProofpoint found that attackers are abusing OAuth client ID spoofing in Microsoft Entra ID to enumerate accounts and validate credentials without creating successful sign-in events.