Hackers find a new trick to collect Microsoft Entra user data without raising red flags

Proofpoint observed multiple large-scale campaigns abusing spoofed OAuth client IDs against Microsoft Entra (Azure AD) to enumerate user accounts and infer password validity without generating successful sign-in events. Attackers used millions of spoofed IDs across thousands of organizations, enabling stealthy reconnaissance that can bypass trend-based monitoring and conditional-access policies; defenders are advised to monitor for blank application IDs and AADSTS700016 errors.