OAuth Client ID Spoofing Lets Attackers Enumerate Entra ID Accounts Without a Trace
Do Son 
Custom Invoke-ClientIdSpoofEnum tool
At a Glance
| Field | Detail |
|---|---|
| Actors | UNK_pyreq2323 and UNK_OutFlareAZ (two independent, unattributed clusters) |
| Activity | Account enumeration and credential validation via OAuth client ID spoofing |
| Targets | Microsoft Entra ID (Azure AD) tenants |
| Scale | 3M+ users across thousands of tenants; 4.4M+ spoofed client IDs combined |
| Status | Active campaigns; no arrests or law-enforcement action reported |
| Source | Proofpoint Threat Insight (July 13, 2026) |
TL;DR
Proofpoint has detailed a stealthy technique called OAuth client ID spoofing. It lets attackers enumerate Microsoft Entra ID accounts and test stolen passwords without producing a successful sign-in event. Two large, independent campaigns already use it, which suggests the method is spreading fast.
What Happened
Proofpoint researchers observed attackers abusing how Microsoft Entra ID handles OAuth client IDs. A client ID is a unique GUID that names the application making an authentication request. Entra records it as the application ID in sign-in logs.
Attackers simply invent a fake client ID. Because the spoofed value maps to no registered application, Entra logs the attempt with a blank application name. Detection rules that watch for surges against named apps miss the activity entirely.
The researchers reproduced the method against Entra ID. They sent POST requests to Microsoft’s OAuth 2.0 token endpoint using the Resource Owner Password Credentials (ROPC) flow, which accepts a username and password directly. Distinct AADSTS error codes then reveal whether the username exists and whether the password is valid.
The Detection Blind Spot
As Proofpoint puts it, “spoofed client IDs enable account enumeration without a registered OAuth application.” The report adds that attackers can “infer both password and account validity without generating a successful sign-in event.” Notably, a valid username and password returns error AADSTS700016. That code can therefore signal compromised credentials, not just a failed login.
Who Is Behind It
Proofpoint tracks two clusters and does not name any group. Attribution confidence is low, and the two campaigns appear unrelated.
UNK_pyreq2323
This campaign surfaced on January 14, 2026. It ran from AWS infrastructure under the user agent python-requests/2.32.3. The operator spread enumeration across more than 700,000 spoofed client IDs by randomizing the trailing digits of a known Exchange Online identifier.
UNK_OutFlareAZ
This larger campaign began in December 2025 and ran mainly from Cloudflare infrastructure. It generated a fully random UUIDv4 for each request, a more mature approach that limits correlation. Proofpoint calls this variation evidence of “independent adoption of the same underlying technique.”
Impact and Scale
The combined reach is significant. UNK_pyreq2323 targeted over one million users across nearly 4,000 tenants, and its failed attempts triggered account lockouts for roughly 28% of targeted users. UNK_OutFlareAZ went further, hitting more than two million users with about 3.7 million spoofed application IDs.
Both campaigns reused generic username wordlists, such as jsmith and mjones, across many organizations. These figures come from Proofpoint’s telemetry and reflect the vendor’s estimates.
How to Stay Protected
Defenders should rethink assumptions about their sign-in logs. Proofpoint recommends treating log entries with a blank application name, or a missing application ID, as possible indicators of client ID spoofing.
Teams should also recognize that an AADSTS700016 error may mean valid credentials were found. For deeper detection guidance, read the full Proofpoint OAuth client ID spoofing research. Strong phishing-resistant MFA and disabling legacy ROPC authentication further reduce exposure to this account enumeration tradecraft.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
