OAuth Client ID Spoofing Enables Stealthy Enumeration of Microsoft Entra ID Accounts (UNK_pyreq2323 / UNK_OutFlareAZ)

Key facts for Microsoft Entra OAuth spoofing

Detection coverage for Microsoft Entra OAuth spoofing

As of 2026-09-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2476 across Splunk SPL, Microsoft KQL and Sigma, covering 5 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Confirmed-Valid Credential Signal (AADSTS700016) Preceding Entra ID Smart Lockout

Detects the high-confidence compromise chain where a ROPC request with a spoofed/unrecognized client_id returns AADSTS700016 for a username (meaning the submitted password was VALID but the application identifier was unrecognized) followed within one hour by the same account entering Entra ID smart lockout (AADSTS50053) from continued authentication attempts. This corresponds to Proofpoint's post-validation stage: the attacker has confirmed working credentials via client ID spoofing and continues brute-force/credential-stuffing attempts, driving the account into lockout as observed for ~28% of UNK_pyreq2323's targeted accounts.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1078.004, T1110.004, T1531, T1589.001
• Data sources: Entra ID Sign-in Logs (SigninLogs), Azure AD Non-Interactive Sign-in Logs, Entra ID Risk Detections / Identity Protection events
• Severity: critical
• Confidence: high

Splunk SPL

index=azure_ad sourcetype="azure:aad:signin"
| rename properties.appDisplayName as app_display_name, properties.appId as app_id, properties.status.errorCode as error_code, properties.userPrincipalName as upn, properties.ipAddress as src_ip
| where (isnull(app_display_name) OR app_display_name="" OR app_display_name="Unknown") AND error_code="700016"
| eval confirmed_time=_time
| rename upn as join_upn
| join type=inner join_upn [
    search index=azure_ad sourcetype="azure:aad:signin" properties.status.errorCode="50053"
    | rename properties.userPrincipalName as join_upn
    | eval lockout_time=_time
    | fields join_upn, lockout_time
  ]
| where lockout_time > confirmed_time AND (lockout_time - confirmed_time) < 3600
| table join_upn, src_ip, confirmed_time, lockout_time, app_id
| sort - confirmed_time

Microsoft KQL

let ConfirmedValid = SigninLogs
| where TimeGenerated > ago(24h)
| where ResultType == "700016"
| where isempty(AppDisplayName) or AppDisplayName == "Unknown"
| project UserPrincipalName, ConfirmedTime = TimeGenerated, IPAddress, AppId;
let Lockouts = SigninLogs
| where TimeGenerated > ago(24h)
| where ResultType == "50053"
| project UserPrincipalName, LockoutTime = TimeGenerated;
ConfirmedValid
| join kind=inner (Lockouts) on UserPrincipalName
| where LockoutTime > ConfirmedTime and LockoutTime - ConfirmedTime < 1h
| project UserPrincipalName, IPAddress, AppId, ConfirmedTime, LockoutTime
| order by ConfirmedTime desc

Sigma

title: Confirmed-Valid Credential Signal (AADSTS700016) Preceding Entra ID Smart Lockout
id: 3a8c1e4f-6d2b-4a9e-8f7c-1b5e9d4a2c33
status: experimental
description: Detects an Entra ID sign-in with AADSTS700016 (valid credentials, unrecognized application) for an account, followed within one hour by an Entra ID smart lockout (AADSTS50053) for the same account — indicating an attacker confirmed working credentials via OAuth client ID spoofing and continued brute-force/credential-stuffing attempts against the account.
references:
    - https://www.proofpoint.com/us/blog/threat-insight/oauth-client-id-spoofing-why-fake-client-ids-are-gaining-traction-stealthy
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-13
tags:
    - attack.credential-access
    - attack.t1110.004
    - attack.initial-access
    - attack.t1078.004
    - attack.impact
    - attack.t1531
logsource:
    product: azure
    service: signinlogs
detection:
    selection_confirmed:
        ResultType: '700016'
        AppDisplayName:
            - ''
            - null
            - 'Unknown'
    selection_lockout:
        ResultType: '50053'
    timeframe: 1h
    condition: selection_confirmed and selection_lockout | correlate by UserPrincipalName within timeframe
falsepositives:
    - Legitimate user repeatedly mistyping their password shortly after an unrelated benign app-registration error
    - Password rotation or credential-migration events colliding with a misconfigured legacy application within the correlation window
level: critical

Known false positives:

• Legitimate user repeatedly mistyping their password shortly after an unrelated benign app-registration error
• Password rotation or credential-migration events colliding with a misconfigured legacy application within the correlation window

Tuning notes: Treat any match as a P1 credential-compromise ticket (not a routine lockout) per Proofpoint guidance: force password reset and revoke sessions/refresh tokens for the account immediately; widen the correlation window beyond 1 hour for slow/low-and-slow variants and narrow it for high-volume single-session attacks; suppress pairs where the source IP for both events matches a known corporate egress range.

• 🔒 Entra ID ROPC Enumeration via Blank Application Name and AADSTS Differential Errors · unlock with TL Creds
• 🔒 Confirmed-Valid Credential Signal (AADSTS700016) Preceding Entra ID Smart Lockout · unlock with TL Creds
• 🔒 High OAuth Client-ID Cardinality per Source IP with Spoofed User-Agent (Enumeration Infrastructure) · unlock with TL Creds
• 🔒 Entra ID ROPC Enumeration via Blank Application Name and AADSTS Differential Errors · unlock with TL Creds
• 🔒 Confirmed-Valid Credential Signal (AADSTS700016) Preceding Entra ID Smart Lockout · unlock with TL Creds
• 🔒 High OAuth Client-ID Cardinality per Source IP with Spoofed User-Agent (Enumeration Infrastructure) · unlock with TL Creds
• 🔒 Entra ID ROPC Enumeration via Blank Application Name and AADSTS Differential Errors · unlock with TL Creds
• 🔒 High OAuth Client-ID Cardinality per Source IP with Spoofed User-Agent (Enumeration Infrastructure) · unlock with TL Creds

Indicators of compromise for Microsoft Entra OAuth spoofing

As of 2026-09-13, Threadlinqs Intelligence tracks 5 indicators of compromise for TL-2026-2476.

Sample indicators (1 of 5)

• URL: hxxps://login[.]microsoftonline[.]com/common/oauth2/token

Defanged, TLP:CLEAR. Full set of 5 indicators: unlock with TL Creds.

How Microsoft Entra OAuth spoofing works

OAuth Client ID Spoofing abuses the Resource Owner Password Credentials (ROPC) grant of Microsoft's OAuth 2.0 token endpoint (`/common/oauth2/token`). An attacker submits a direct HTTP POST containing a username, a password, and a `client_id` GUID that is either fabricated, randomized, or a mutated variant of a known Microsoft first-party application ID — critically, the application does not need to be registered or consented to in the target tenant for the endpoint to respond. Microsoft Entra ID's distinct AADSTS error responses let the caller differentiate account state without ever completing a logged sign-in: AADSTS50034 (UserAccountNotFound) indicates the username does not exist; AADSTS50126 indicates the username exists but the supplied password is wrong; and AADSTS700016 ("application identifier was not found in the directory") is returned when the username/password pair is VALID but the application identifier is unrecognized. Because AADSTS700016 looks like a broken app registration rather than a credential-validation event, and because unregistered/spoofed client IDs produce sign-in log rows with a blank Application ID/Application Name field, defenses that alert on sign-in surges against a named application miss the activity entirely.

UNK_pyreq2323 emerged January 14, 2026, operating from AWS infrastructure with the default `python-requests/2.32.3` HTTP client user agent. It generated 700,000+ spoofed client IDs by mutating the final six digits of a known Exchange Online first-party application ID prefix (`00000002-0000-0ff1-ce00-`), reusing each spoofed ID against as many as 12 different target usernames, with no sequential ordering. The cluster touched over 1 million accounts across roughly 4,000 tenants, peaking in late January through early February 2026 and continuing activity into March 2026; approximately 28% of targeted accounts were driven into Entra ID smart lockout as a side effect of the volume of failed authentication attempts.

UNK_OutFlareAZ began operating in December 2025 (first wave ~242,000 users, December 10 through late December 2025) from Cloudflare-fronted infrastructure, spoofing a User-Agent string that mimics a legitimate Outlook desktop client (`Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.12026; Pro`). It generated 3.7 million fully random UUIDv4 client IDs — one unique ID per request, never reused — making the traffic materially harder to correlate than UNK_pyreq2323's reused-ID pattern. A second, larger wave ran from early February through March 15, 2026, peaking at roughly 720,000 users in a single day, and cumulatively touched over 2 million accounts. Usernames were enumerated in alphabetical order using a generic first-initial-plus-surname wordlist (e.g., dsmith, msmith, jbrown) repeated across many tenants, suggesting a shared target-list methodology.

Proofpoint assesses the two clusters independently and convergently adopted the same underlying ROPC/client-ID-spoofing technique rather than sharing tooling, based on divergent infrastructure, user agents, ID-generation strategy, and enumeration ordering. Neither cluster is attributed to a named, tracked threat actor. Detection requires correlating on fields other than application identity — client-ID cardinality per source IP/ASN/user agent, AADSTS700016/50126/50034 result-code surges, and sign-in rows with a blank Application Name — plus longer-term mitigation via disabling ROPC, hardening Conditional Access to apply irrespective of application registration, and treating AADSTS700016 as a potential credential-compromise signal rather than a benign configuration error.

MITRE ATT&CK techniques by tactic:

Stealth

T1036.005 Match Legitimate Resource Name or Location

Initial Access

T1078.004 Cloud Accounts

Discovery

T1087.004 Cloud Account

Command and Control

T1090.002 External Proxy

Credential Access

T1110.004 Credential Stuffing

Impact

T1531 Account Access Removal

Defense Impairment

T1556.009 Conditional Access Policies

Resource Development

T1583.006 Web Services

Reconnaissance

T1589.001 Credentials; T1589.002 Email Addresses; T1589.003 Employee Names

Remediation for Microsoft Entra OAuth spoofing

Patches

• No vendor patch applies — this abuses a legitimate OAuth 2.0 ROPC protocol behavior and Entra ID's differential AADSTS error responses, not a software vulnerability

Immediate actions

• Scope Conditional Access policies to apply tenant-wide/user-based rather than solely to named registered applications, so spoofed/unregistered client IDs are still subject to policy
• Hunt Entra ID sign-in logs for entries with a blank Application ID/Application Name field co-occurring with AADSTS50034, AADSTS50126, or AADSTS700016 result codes
• Treat any AADSTS700016 response paired with an unrecognized client ID as a potential valid-credential signal, not a benign app-registration error; force password reset and revoke sessions/refresh tokens for implicated accounts
• Rate-limit and monitor authentication attempts against the `/common/oauth2/token` ROPC endpoint independent of the client_id/application identity, aggregating by source IP, ASN, and user agent

Workarounds

• Block legacy authentication / ROPC via Conditional Access "block legacy authentication" policies
• Alert on and investigate any surge in distinct client IDs (AppId cardinality) associated with a single source IP, ASN, or user agent within a short window

Longer-term hardening

• Disable the ROPC (Resource Owner Password Credentials) grant type tenant-wide wherever legacy application compatibility allows
• Migrate remaining ROPC-dependent applications to interactive/browser-based OAuth flows, or to managed identities/certificate-based auth for workload identities
• Deploy continuous access evaluation and risk-based Conditional Access that assesses authentication strength, device state, and location at each request rather than relying on per-application policy scoping
• Enforce MFA tenant-wide so that a confirmed-valid password pair cannot alone be used for an actual interactive sign-in

Affected and fixed versions

• Microsoft — Microsoft Entra ID (Azure AD) — OAuth 2.0 Resource Owner Password Credentials (ROPC) token endpoint
  Vulnerable versions: Any Entra ID tenant with the ROPC grant type enabled/reachable at /common/oauth2/token
  Fixed in: Not applicable — mitigated by disabling ROPC and tenant-wide Conditional Access hardening, not a patch

Timeline of Microsoft Entra OAuth spoofing

• 2025-12-10 UNK_OutFlareAZ begins its first activity wave from Cloudflare-fronted infrastructure, touching approximately 242,000 users through late December 2025.
• 2026-01-14 UNK_pyreq2323 activity is first observed, using AWS infrastructure and the locked-ioc-4 user agent to submit ROPC requests with mutated Exchange Online client IDs.
• 2026-01-25 UNK_pyreq2323 reaches peak activity (late January through early February 2026), ultimately generating 700,000+ spoofed client IDs across nearly 4,000 tenants.
• 2026-02-01 UNK_OutFlareAZ begins a second, larger activity wave running through March 15, 2026.
• 2026-02-15 Approximately 28% of UNK_pyreq2323's targeted accounts are driven into Entra ID smart lockout as a byproduct of high-volume failed authentication attempts.
• 2026-03-15 UNK_OutFlareAZ's second wave peaks at roughly 720,000 targeted users in a single day, part of a cumulative 3.7 million randomized spoofed client IDs against 2+ million accounts.
• 2026-07-13 Proofpoint Threat Insight publicly discloses both clusters and the underlying OAuth client ID spoofing / ROPC AADSTS differential-enumeration technique.
• 2026-07-14 Security trade press (The Hacker News, Help Net Security, CSO Online, Cybersecurity News, Hackread, Infosecurity Magazine, Biometric Update) republishes and expands on Proofpoint's findings with SOC detection guidance.
• 2026-08-19 Cloud Security Alliance publishes a follow-up technical analysis ("The Ghost Applications") adding MITRE ATT&CK mapping and expanded mitigation guidance for the technique.

Sources cited for Microsoft Entra OAuth spoofing

• Microsoft Entra authentication & authorization error codes Microsoft · Vendor report · 2026-09-13
• OAuth Client ID Spoofing: Why Fake Client IDs Are Gaining Traction for Stealthy Enumeration Proofpoint · Blog · 2026-07-13
• The Ghost Applications: How OAuth Client ID Spoofing Enumerates Microsoft Entra Accounts Without a Successful Sign-In cloudsecurityalliance.org · Blog · 2026-08-19
• How to detect OAuth client ID spoofing in Microsoft Entra ID before account takeover csoonline.com · Blog · 2026-07-15
• OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials The Hacker News · News · 2026-07-14
• Fake OAuth client IDs are helping attackers slip past sign-in logs Help Net Security · News · 2026-07-13
• Hackers Spoof 3.7 Million OAuth Client IDs to Stealthily Enumerate 2 Million Entra ID Users cybersecuritynews.com · News · 2026-07-14
• Millions of Microsoft Entra Accounts Targeted in OAuth Client ID Spoofing Campaigns hackread.com · News · 2026-07-14
• Novel OAuth Client ID Spoofing Technique Targets Cloud Environments infosecurity-magazine.com · News · 2026-07-14
• Attackers spoofing OAuth client IDs to cloak Entra compromise attempts: Proofpoint biometricupdate.com · News · 2026-07-14

More in cloud

• The Rise of LLMJacking: Threat Actors Monetize Compromised Cloud and Model Resources (UNC6993, D1337-KAIROS, CVE-2026-40217)
• Password Spraying Campaign Targets AWS Root User Accounts Across 150+ Organizations
• From Phishing to LLMjacking: Threat Actors Hijacking GCP Billing Accounts for Gemini API Usage
• AWS EKS Forensics: Data Sources and Investigation Tooling (Synacktiv)
• AWS AI Agent Vulnerabilities (Loom, SageMaker Unified Studio) Let Attackers Bypass Authentication and Steal Credentials - CVE-2026-103956, CVE-2026-103957, CVE-2026-103958, CVE-2026-104019

Related coverage of this activity

• UNK_OutFlareAZ Entra ROPC abuse
• UNK_pyreq2323 Entra ID enumeration