Millions of Microsoft Entra Accounts Targeted in OAuth Client ID Spoofing Campaigns

- Researchers observed multiple large campaigns using spoofed OAuth client IDs against Microsoft Entra ID to enumerate and validate credentials by interpreting specific AADSTS error codes (e.g., AADSTS50126, AADSTS50034, AADSTS700016). Two campaigns (UNK_pyreq2323 and UNK_OutFlareAZ) targeted millions of accounts across thousands of tenants using AWS and Cloudflare infrastructure, varied user agents and request patterns, and generated hundreds of thousands to millions of spoofed client IDs to evade application-level detections and cause significant account lockouts.