OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials

Proofpoint has identified active campaigns exploiting a technique called "OAuth client ID spoofing" to enumerate user accounts and validate stolen credentials in Microsoft Entra ID environments while avoiding successful sign-in telemetry. Two large campaigns (UNK_pyreq2323 and UNK_OutFlareAZ) targeted millions of users across thousands of tenants, using randomized or modified client IDs to evade detections and rate-limiting, enabling large-scale credential checking and stealthy access reconnaissance.