OAuth Client ID Spoofing Enables Stealthy Enumeration of Microsoft Entra ID Accounts (UNK_pyreq2323 / UNK_OutFlareAZ)
OAuth Client ID Spoofing Enables Stealthy Enumeration of (TL-2026-2476), also tracked as OAuth Client ID Spoofing, is a high-severity cloud security threat, first published 2026-09-13. It is attributed to UNK_OutFlareAZ with low confidence, affects Microsoft Microsoft Entra ID (Azure AD) — OAuth 2.0 Resource Owner, maps to 11 MITRE ATT&CK techniques (T1036.005, T1078.004, T1087.004), and is covered by 9 detection rules and 5 indicators of compromise.
Key facts for TL-2026-2476
- Threat ID
- TL-2026-2476
- Also known as
- OAuth Client ID Spoofing, Ghost Applications
- Severity
- HIGH
- Status
- ACTIVE
- Category
- CLOUD
- First published
- 2026-09-13
- Last reviewed
- 2026-09-13
- Attribution
- UNK_OutFlareAZ
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- cross-sector, any-microsoft-365-tenant
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 5
Malware and tooling in OAuth Client ID Spoofing Enables Stealthy Enumeration of
Malware and tooling: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.12026; Pro, python-requests/2.32.3
Proofpoint documents two independent, unattributed activity clusters — UNK_pyreq2323 and UNK_OutFlareAZ — abusing fabricated OAuth application (client) IDs against Microsoft Entra ID's ROPC token endpoint to enumerate accounts and validate stolen credentials without generating successful sign-in events. Together the clusters used over 4.4 million spoofed client IDs to touch more than 1 million and 2 million accounts respectively across thousands of tenants.
How OAuth Client ID Spoofing Enables Stealthy Enumeration of works
OAuth Client ID Spoofing abuses the Resource Owner Password Credentials (ROPC) grant of Microsoft's OAuth 2.0 token endpoint (`/common/oauth2/token`). An attacker submits a direct HTTP POST containing a username, a password, and a `client_id` GUID that is either fabricated, randomized, or a mutated variant of a known Microsoft first-party application ID — critically, the application does not need to be registered or consented to in the target tenant for the endpoint to respond. Microsoft Entra ID's distinct AADSTS error responses let the caller differentiate account state without ever completing a logged sign-in: AADSTS50034 (UserAccountNotFound) indicates the username does not exist; AADSTS50126 indicates the username exists but the supplied password is wrong; and AADSTS700016 ("application identifier was not found in the directory") is returned when the username/password pair is VALID but the application identifier is unrecognized. Because AADSTS700016 looks like a broken app registration rather than a credential-validation event, and because unregistered/spoofed client IDs produce sign-in log rows with a blank Application ID/Application Name field, defenses that alert on sign-in surges against a named application miss the activity entirely.
UNK_pyreq2323 emerged January 14, 2026, operating from AWS infrastructure with the default `python-requests/2.32.3` HTTP client user agent. It generated 700,000+ spoofed client IDs by mutating the final six digits of a known Exchange Online first-party application ID prefix (`00000002-0000-0ff1-ce00-`), reusing each spoofed ID against as many as 12 different target usernames, with no sequential ordering. The cluster touched over 1 million accounts across roughly 4,000 tenants, peaking in late January through early February 2026 and continuing activity into March 2026; approximately 28% of targeted accounts were driven into Entra ID smart lockout as a side effect of the volume of failed authentication attempts.
UNK_OutFlareAZ began operating in December 2025 (first wave ~242,000 users, December 10 through late December 2025) from Cloudflare-fronted infrastructure, spoofing a User-Agent string that mimics a legitimate Outlook desktop client (`Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.12026; Pro`). It generated 3.7 million fully random UUIDv4 client IDs — one unique ID per request, never reused — making the traffic materially harder to correlate than UNK_pyreq2323's reused-ID pattern. A second, larger wave ran from early February through March 15, 2026, peaking at roughly 720,000 users in a single day, and cumulatively touched over 2 million accounts. Usernames were enumerated in alphabetical order using a generic first-initial-plus-surname wordlist (e.g., dsmith, msmith, jbrown) repeated across many tenants, suggesting a shared target-list methodology.
Proofpoint assesses the two clusters independently and convergently adopted the same underlying ROPC/client-ID-spoofing technique rather than sharing tooling, based on divergent infrastructure, user agents, ID-generation strategy, and enumeration ordering. Neither cluster is attributed to a named, tracked threat actor. Detection requires correlating on fields other than application identity — client-ID cardinality per source IP/ASN/user agent, AADSTS700016/50126/50034 result-code surges, and sign-in rows with a blank Application Name — plus longer-term mitigation via disabling ROPC, hardening Conditional Access to apply irrespective of application registration, and treating AADSTS700016 as a potential credential-compromise signal rather than a benign configuration error.
MITRE ATT&CK techniques used in TL-2026-2476
Stealth
T1036.005 Match Legitimate Resource Name or Location
Initial Access
Discovery
Command and Control
Credential Access
Impact
Defense Impairment
T1556.009 Conditional Access Policies
Resource Development
Reconnaissance
T1589.001 Credentials; T1589.002 Email Addresses; T1589.003 Employee Names
Affected products and versions in OAuth Client ID Spoofing Enables Stealthy Enumeration of
- Microsoft — Microsoft Entra ID (Azure AD) — OAuth 2.0 Resource Owner Password Credentials (ROPC) token endpoint
Vulnerable versions: Any Entra ID tenant with the ROPC grant type enabled/reachable at /common/oauth2/token
Fixed in: Not applicable — mitigated by disabling ROPC and tenant-wide Conditional Access hardening, not a patch
Remediation for OAuth Client ID Spoofing Enables Stealthy Enumeration of
Patches
- No vendor patch applies — this abuses a legitimate OAuth 2.0 ROPC protocol behavior and Entra ID's differential AADSTS error responses, not a software vulnerability
Immediate actions
- Scope Conditional Access policies to apply tenant-wide/user-based rather than solely to named registered applications, so spoofed/unregistered client IDs are still subject to policy
- Hunt Entra ID sign-in logs for entries with a blank Application ID/Application Name field co-occurring with AADSTS50034, AADSTS50126, or AADSTS700016 result codes
- Treat any AADSTS700016 response paired with an unrecognized client ID as a potential valid-credential signal, not a benign app-registration error; force password reset and revoke sessions/refresh tokens for implicated accounts
- Rate-limit and monitor authentication attempts against the `/common/oauth2/token` ROPC endpoint independent of the client_id/application identity, aggregating by source IP, ASN, and user agent
Workarounds
- Block legacy authentication / ROPC via Conditional Access "block legacy authentication" policies
- Alert on and investigate any surge in distinct client IDs (AppId cardinality) associated with a single source IP, ASN, or user agent within a short window
Longer-term hardening
- Disable the ROPC (Resource Owner Password Credentials) grant type tenant-wide wherever legacy application compatibility allows
- Migrate remaining ROPC-dependent applications to interactive/browser-based OAuth flows, or to managed identities/certificate-based auth for workload identities
- Deploy continuous access evaluation and risk-based Conditional Access that assesses authentication strength, device state, and location at each request rather than relying on per-application policy scoping
- Enforce MFA tenant-wide so that a confirmed-valid password pair cannot alone be used for an actual interactive sign-in
Weaknesses (CWE) in OAuth Client ID Spoofing Enables Stealthy Enumeration of
CWE-307
Timeline of OAuth Client ID Spoofing Enables Stealthy Enumeration of
- UNK_OutFlareAZ begins its first activity wave from Cloudflare-fronted infrastructure, touching approximately 242,000 users through late December 2025.
- UNK_pyreq2323 activity is first observed, using AWS infrastructure and the python-requests/2.32.3 user agent to submit ROPC requests with mutated Exchange Online client IDs.
- UNK_pyreq2323 reaches peak activity (late January through early February 2026), ultimately generating 700,000+ spoofed client IDs across nearly 4,000 tenants.
- UNK_OutFlareAZ begins a second, larger activity wave running through March 15, 2026.
- Approximately 28% of UNK_pyreq2323's targeted accounts are driven into Entra ID smart lockout as a byproduct of high-volume failed authentication attempts.
- UNK_OutFlareAZ's second wave peaks at roughly 720,000 targeted users in a single day, part of a cumulative 3.7 million randomized spoofed client IDs against 2+ million accounts.
- Proofpoint Threat Insight publicly discloses both clusters and the underlying OAuth client ID spoofing / ROPC AADSTS differential-enumeration technique.
- Security trade press (The Hacker News, Help Net Security, CSO Online, Cybersecurity News, Hackread, Infosecurity Magazine, Biometric Update) republishes and expands on Proofpoint's findings with SOC detection guidance.
- Cloud Security Alliance publishes a follow-up technical analysis ("The Ghost Applications") adding MITRE ATT&CK mapping and expanded mitigation guidance for the technique.
Sources cited for OAuth Client ID Spoofing Enables Stealthy Enumeration of
- OAuth Client ID Spoofing: Why Fake Client IDs Are Gaining Traction for Stealthy Enumeration
- OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials
- The Ghost Applications: How OAuth Client ID Spoofing Enumerates Microsoft Entra Accounts Without a Successful Sign-In
- Fake OAuth client IDs are helping attackers slip past sign-in logs
- How to detect OAuth client ID spoofing in Microsoft Entra ID before account takeover
- Hackers Spoof 3.7 Million OAuth Client IDs to Stealthily Enumerate 2 Million Entra ID Users
- Millions of Microsoft Entra Accounts Targeted in OAuth Client ID Spoofing Campaigns
- Novel OAuth Client ID Spoofing Technique Targets Cloud Environments
- Attackers spoofing OAuth client IDs to cloak Entra compromise attempts: Proofpoint
- Microsoft Entra authentication & authorization error codes
More in cloud
- Frontier AI Agents Compress Full Enterprise Intrusion Chain into Under 10 Hours (Unit 42 Investigation)
- Password Spraying Campaign Targets AWS Root User Accounts Across 150+ Organizations
- AWS IAM Privilege Escalation Attack Path via iam:CreateAccessKey, iam:UpdateLoginProfile, and iam:UpdateAssumeRolePolicy (Horizon3.ai NodeZero Case Study)
- AWS SSM Agent Abused as a Living-off-the-Land Remote Access Trojan via Hybrid-Activation Hijacking and Parallel Agent Processes
- GCP Cross-Project Compute Image Exfiltration via Compromised Developer Credentials
Detection coverage for TL-2026-2476
As of 2026-09-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2476 across Splunk SPL, Microsoft KQL and Sigma, covering 5 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.