OAuth Client ID Spoofing Lets Attackers Validate Entra Credentials Stealthily
Proofpoint uncovered OAuth client ID spoofing in Microsoft Entra ID, where attackers send ROPC token requests with forged client IDs to verify usernames and passwords without creating a successful sign‑in event. The technique lets threat groups enumerate accounts at scale while evading typical log‑based alerts, forcing defenders to monitor for sign‑ins lacking a known application ID.