OAuth Client ID Spoofing Enables Silent Credential Validation Against Microsoft Entra ID — UNK_pyreq2323 & UNK_OutFlareAZ — Threadlinqs Intelligence
As of 2026-07-14, OAuth Client ID Spoofing Enables Silent Credential Validation Against Microsoft Entra ID — UNK_pyreq2323 & UNK_OutFlareAZ is a high-severity vulnerability threat attributed to UNK_pyreq2323, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 15 indicators of compromise.
Threat ID: TL-2026-1342 · Severity: HIGH · Status: ACTIVE · Category: VULNERABILITY
Attribution: UNK_pyreq2323 · UNKNOWN
Two distinct threat clusters, UNK_pyreq2323 and UNK_OutFlareAZ, are abusing Microsoft Entra ID's OAuth 2.0 Resource Owner Password Credentials (ROPC) token endpoint with spoofed, non-registered client
Proofpoint threat research (published July 2026, syndicated by The Hacker News, Help Net Security, Infosecurity Magazine, Cybersecurity Dive, and others) documents a previously under-appreciated blind spot in Microsoft Entra ID's OAuth 2.0 token endpoint (`/common/oauth2/token`): the Azure AD Security Token Service (AADSTS) returns materially different error codes depending on whether the submitted `client_id` corresponds to a real, registered application, and independently, whether the submitted username/password pair is valid. Because the ROPC grant type accepts a username and password directly in the POST body alongside an arbitrary `client_id` parameter, an attacker never needs to register or control a real Entra application — they only need a syntactically plausible (or even malformed) GUID.
When the client ID does not resolve to a registered application, Entra ID still processes the credential check and returns an AADSTS error, but the sign-in log entry that results has an application ID with no corresponding application name. This lets attackers infer three things purely from error codes and without generating a single successful authentication: (1) whether a username exists at all (AADSTS50034 for non-existent accounts, which Entra does not log to the sign-in log), (2) whether an existing username's password is wrong (AADSTS50126), and (3) whether the username and password pair is fully valid (AADSTS700016 — 'application not found in directory', returned only once credentials check out). None of these produce a successful interactive or non-interactive sign-in record, so account-takeover and password-spray detections tuned to successful logons or to specific first-party/third-party application names never fire.
Two clusters were tracked operating this technique at industrial scale. UNK_pyreq2323 ran from January 14 through early March 2026 (peaking late January/early February), using the Python `requests` library (`python-requests/2.32.3` User-Agent) from Amazon Web Services infrastructure. It generated more than 700,000 spoofed client IDs by taking Microsoft's own first-party Exchange Online application ID prefix (`00000002-0000-0ff1-ce00-`) and randomizing the trailing six hex digits, reusing each spoofed ID across up to 12 different target users. It targeted over 1 million accounts across roughly 4,000 Entra tenants, and its aggressive password-attempt volume caused Entra ID smart lockout to trigger for approximately 28% of targeted accounts — a side effect that made the campaign detectable primarily through account-lockout spikes rather than through sign-in telemetry.
UNK_OutFlareAZ was more mature and began earlier, in December 2025, operating in at least two distinct waves (a December 2025 wave peaking around 242,000 targeted users, and a February–March 2026 wave peaking around 720,000 users on March 15, 2026). It routed traffic through Cloudflare infrastructure, spoofed a User-Agent string mimicking Microsoft Outlook (`Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.12026; Pro`), generated a fully randomized, unique UUIDv4 client ID for every single authentication attempt (rather than reusing IDs), and enumerated usernames alphabetically using precompiled wordlists — targeting over 2 million users with 3.7 million distinct spoofed application IDs in total. The full randomization of client IDs per request meant no single fictitious application ID ever appeared more than once in logs, defeating any detection logic keyed on repeated anomalous application IDs.
Both clusters' techniques were validated and reproduced by researchers using a proof-of-concept PowerShell tool, `Invoke-ClientIdSpoofEnum`, confirming the enumeration and credential-validation behavior is trivially scriptable against any Entra ID tenant that has not disabled the legacy ROPC grant type. No CVE has been assigned; Microsoft has not classified this as a vulnerability in the traditional sense but rather as an abuse of legitimate
Weaknesses (CWE)
CWE-203, CWE-307, CWE-799
Target sectors: cross-sector, enterprise-saas-tenants, finance, health, government administration, technology
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 15 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, T1589, T1589.002, T1589.001, T1595, T1583.006, T1587.001, T1588.002, T1110, T1110.001, T1110.003