OAuth Client ID Spoofing Validates Stolen Entra Credentials

A novel cyberattack technique that allows threat actors to stealthily test and validate stolen login credentials against Microsoft cloud accounts is being adopted by multiple hacking groups, according to new research. The method, known as OAuth client ID spoofing, exploits a logging behavior in Microsoft Entra ID, the company's cloud identity service, enabling attackers to confirm valid usernames and passwords without triggering standard security alerts.

Security analysts at Proofpoint detailed how attackers are abusing the OAuth authentication process by submitting syntactically valid but unregistered application identifiers, known as client IDs, during login attempts. When Microsoft Entra ID processes these spoofed IDs, it returns specific error codes that reveal whether a submitted username exists and whether the accompanying password is correct. Crucially, when a valid username-password pair is submitted with a spoofed client ID, the system returns an "AADSTS700016" error, indicating an unrecognized application. This response confirms the credential pair works without generating a successful sign-in event in the tenant's security logs.

This creates a significant blind spot...