OAuth Client ID Spoofing Enables Stealthy Enumeration and Credential Validation Against Microsoft Entra ID (UNK_pyreq2323 / UNK_OutFlareAZ) — Threadlinqs Intelligence
As of 2026-07-14, OAuth Client ID Spoofing Enables Stealthy Enumeration and Credential Validation Against Microsoft Entra ID (UNK_pyreq2323 / UNK_OutFlareAZ) is a high-severity threat intel threat attributed to UNK_pyreq2323, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-1321 · Severity: HIGH · Status: ACTIVE · Category: THREAT_INTEL
Attribution: UNK_pyreq2323 · UNKNOWN
Two distinct threat clusters — UNK_pyreq2323 and UNK_OutFlareAZ — are abusing the Resource Owner Password Credentials (ROPC) OAuth 2.0 flow against Microsoft Entra ID by submitting spoofed/fabricated
Proofpoint threat research disclosed a stealthy account-enumeration and credential-validation technique that abuses Microsoft Entra ID's Resource Owner Password Credentials (ROPC) OAuth 2.0 grant. Entra ID's token endpoint (login.microsoftonline.com) accepts a client_id parameter identifying the calling application. When an attacker submits an arbitrary or non-existent client_id together with a username/password pair, Entra ID does not reject the request outright even when the client_id is not a well-formed UUIDv4. Instead, it evaluates the credentials first and only then flags the unrecognized application, returning AADSTS700016 (application identifier not recognized) when the username and password are BOTH valid. Combined with AADSTS50034 (username does not exist, not written to the sign-in log) and AADSTS50126 (valid username, invalid password), the three distinct error codes give an attacker an oracle: they can enumerate which usernames exist in a tenant and separately confirm whether stolen/guessed passwords are correct, all without ever completing a successful sign-in event and without MFA ever being invoked (ROPC is a legacy non-interactive flow that predates modern MFA challenge support). Crucially, when the client_id is spoofed/unregistered, Entra ID's sign-in log entry is written with a BLANK application name field, so defenses and hunts that pivot on 'which app is failing logins' or scope Conditional Access policies to specific first-party application IDs never fire.
Two independent threat clusters were observed operationalizing this technique at internet scale. UNK_pyreq2323 (first observed 2026-01-14, active through early March 2026) operated from AWS-hosted infrastructure using the default python-requests/2.32.3 HTTP client user agent, generating spoofed client IDs by taking the legitimate Microsoft Exchange Online first-party application ID prefix (00000002-0000-0ff1-ce00-) and randomizing the trailing six hex digits to a non-zero value, reusing each fabricated ID against as many as 12 different target usernames before rotating. The campaign targeted over 1 million unique user accounts across roughly 4,000 Entra ID tenants using 700,000+ distinct spoofed client IDs, and caused account lockouts (via Entra ID smart lockout / conditional access thresholds) for approximately 28% of targeted users — collateral damage consistent with brute-force/password-spray velocity rather than careful low-and-slow enumeration.
UNK_OutFlareAZ (first observed December 2025, continuing through at least March 2026 in two distinct waves — a December 2025 wave peaking near 242,000 targeted users and a second wave peaking around 2026-03-15 at roughly 720,000 targeted users) originated primarily from Cloudflare-fronted infrastructure and forged a Microsoft Outlook desktop client user agent string (Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.12026; Pro...)) to blend into legitimate Outlook ROPC traffic patterns still seen from older desktop mail clients. Rather than reusing a recognizable Microsoft application ID prefix, UNK_OutFlareAZ generated a fully random UUIDv4 client_id for every single authentication attempt (3.7 million distinct spoofed client IDs against 2 million+ targeted users), and enumerated common/generic username patterns (e.g., dsmith, msmith, jbrown-style first-initial-lastname handles) alphabetically across many tenants simultaneously — a pattern consistent with automated dictionary-driven enumeration rather than a targeted list.
Proofpoint assesses the two clusters as independently operated (distinct infrastructure, user-agent, client-ID-generation strategy, and targeting cadence) rather than a single actor, indicating that OAuth client ID spoofing against ROPC is becoming broadly adopted tradecraft rather than a single group's bespoke tooling. The technique is closely related to, and likely compounds, the ongoing large-scale ROPC password-spray activity against Microsoft 365/Entra ID and Azure CL
Weaknesses (CWE)
CWE-287, CWE-307, CWE-778
Target sectors: technology, finance, government administration, health, education, professional-services, retail
Target regions: Global, North America
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
THREAT_INTEL, HIGH, threat intelligence, cybersecurity, T1589, T1589, T1583, T1585, T1588, T1078, T1110, T1110, T1087, T1201