Proofpoint spots Entra ID spoofing attack technique
Security researchers at Proofpoint have identified a new technique where attackers spoof OAuth client IDs to enumerate Microsoft Entra ID accounts. This method allows threat actors to validate usernames and passwords while bypassing standard security monitoring and conditional access policies.
Why it matters
This vulnerability creates a significant visibility gap for enterprise security teams, making it harder to detect password-spraying and account enumeration attacks.
Proofpoint has identified a cloud attack technique that lets threat actors enumerate Microsoft Entra ID accounts by spoofing OAuth client IDs. The method has appeared in multiple large-scale campaigns.
Attackers can use fake client identifiers in authentication requests to test whether usernames exist, infer whether passwords are valid and identify viable accounts without registering an OAuth application. In doing so, they avoid generating the successful sign-in events that security teams often rely on to monitor Microsoft Entra environments.
The technique hinges on how Entra responds to requests sent to Microsoft's OAuth token endpoint under the Resource Owner Password Credentials flow. Different AADSTS error codes reveal whether a username is invalid, whether a password is wrong and, in some cases, whether a username and password pair is valid even when the application identifier itself is not recognised.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in