# OAuth Client ID Spoofing Enables Stealthy Enumeration of Microsoft Entra ID Accounts (UNK_pyreq2323 / UNK_OutFlareAZ)

> Proofpoint documents two independent, unattributed activity clusters — UNK_pyreq2323 and UNK_OutFlareAZ — abusing fabricated OAuth application (client) IDs against Microsoft Entra ID's ROPC token endpoint to enumerate accounts and validate stolen credentials without generating successful sign-in events. Together the clusters used over 4.4 million spoofed client IDs to touch more than 1 million and 2 million accounts respectively across thousands of tenants.

- **Published:** 2026-09-13T00:00:00Z
- **Last reviewed:** 2026-09-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2476
- **ID:** TL-2026-2476
- **Severity:** HIGH
- **Category:** CLOUD
- **Status:** ACTIVE
- **Actor:** UNK_OutFlareAZ
- **Detections:** 9 · **IOCs:** 5 (full data via the Threadlinqs MCP server — Purple tier)

## Description

OAuth Client ID Spoofing abuses the Resource Owner Password Credentials (ROPC) grant of Microsoft's OAuth 2.0 token endpoint (`/common/oauth2/token`). An attacker submits a direct HTTP POST containing a username, a password, and a `client_id` GUID that is either fabricated, randomized, or a mutated variant of a known Microsoft first-party application ID — critically, the application does not need to be registered or consented to in the target tenant for the endpoint to respond. Microsoft Entra ID's distinct AADSTS error responses let the caller differentiate account state without ever completing a logged sign-in: AADSTS50034 (UserAccountNotFound) indicates the username does not exist; AADSTS50126 indicates the username exists but the supplied password is wrong; and AADSTS700016 ("application identifier was not found in the directory") is returned when the username/password pair is VALID but the application identifier is unrecognized. Because AADSTS700016 looks like a broken app registration rather than a credential-validation event, and because unregistered/spoofed client IDs produce sign-in log rows with a blank Application ID/Application Name field, defenses that alert on sign-in surges against a named application miss the activity entirely.

UNK_pyreq2323 emerged January 14, 2026, operating from AWS infrastructure with the default `python-requests/2.32.3` HTTP client user agent. It generated 700,000+ spoofed client IDs by mutating the final six digits of a known Exchange Online first-party application ID prefix (`00000002-0000-0ff1-ce00-`), reusing each spoofed ID against as many as 12 different target usernames, with no sequential ordering. The cluster touched over 1 million accounts across roughly 4,000 tenants, peaking in late January through early February 2026 and continuing activity into March 2026; approximately 28% of targeted accounts were driven into Entra ID smart lockout as a side effect of the volume of failed authentication attempts.

UNK_OutFlareAZ began operating in December 2025 (first wave ~242,000 users, December 10 through late December 2025) from Cloudflare-fronted infrastructure, spoofing a User-Agent string that mimics a legitimate Outlook desktop client (`Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.12026; Pro`). It generated 3.7 million fully random UUIDv4 client IDs — one unique ID per request, never reused — making the traffic materially harder to correlate than UNK_pyreq2323's reused-ID pattern. A second, larger wave ran from early February through March 15, 2026, peaking at roughly 720,000 users in a single day, and cumulatively touched over 2 million accounts. Usernames were enumerated in alphabetical order using a generic first-initial-plus-surname wordlist (e.g., dsmith, msmith, jbrown) repeated across many tenants, suggesting a shared target-list methodology.

Proofpoint assesses the two clusters independently and convergently adopted the same underlying ROPC/client-ID-spoofing technique rather than sharing tooling, based on divergent infrastructure, user agents, ID-generation strategy, and enumeration ordering. Neither cluster is attributed to a named, tracked threat actor. Detection requires correlating on fields other than application identity — client-ID cardinality per source IP/ASN/user agent, AADSTS700016/50126/50034 result-code surges, and sign-in rows with a blank Application Name — plus longer-term mitigation via disabling ROPC, hardening Conditional Access to apply irrespective of application registration, and treating AADSTS700016 as a potential credential-compromise signal rather than a benign configuration error.

## MITRE ATT&CK

- T1589.002 Email Addresses
- T1583.006 Web Services
- T1090.002 External Proxy
- T1078.004 Cloud Accounts
- T1110.004 Credential Stuffing
- T1087.004 Cloud Account
- T1036.005 Match Legitimate Resource Name or Location
- T1531 Account Access Removal
- T1589.001 Credentials
- T1589.003 Employee Names
- T1556.009 Conditional Access Policies

## Sources

- [OAuth Client ID Spoofing: Why Fake Client IDs Are Gaining Traction for Stealthy Enumeration](https://www.proofpoint.com/us/blog/threat-insight/oauth-client-id-spoofing-why-fake-client-ids-are-gaining-traction-stealthy)
- [OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials](https://thehackernews.com/2026/07/oauth-client-id-spoofing-lets-attackers.html)
- [The Ghost Applications: How OAuth Client ID Spoofing Enumerates Microsoft Entra Accounts Without a Successful Sign-In](https://cloudsecurityalliance.org/blog/2026/08/19/the-ghost-applications-how-oauth-client-id-spoofing-enumerates-microsoft-entra-accounts-without-a-successful-sign-in)
- [Fake OAuth client IDs are helping attackers slip past sign-in logs](https://www.helpnetsecurity.com/2026/07/13/entra-id-oauth-client-id-spoofing/)
- [How to detect OAuth client ID spoofing in Microsoft Entra ID before account takeover](https://www.csoonline.com/article/4206750/4-million-fake-applications-and-one-blind-spot-a-soc-playbook-for-oauth-client-id-spoofing.html)
- [Hackers Spoof 3.7 Million OAuth Client IDs to Stealthily Enumerate 2 Million Entra ID Users](https://cybersecuritynews.com/hackers-spoof-oauth-client-ids/)
- [Millions of Microsoft Entra Accounts Targeted in OAuth Client ID Spoofing Campaigns](https://hackread.com/microsoft-entra-accounts-oauth-client-id-spoofing/)
- [Novel OAuth Client ID Spoofing Technique Targets Cloud Environments](https://www.infosecurity-magazine.com/news/novel-spoofing-technique-targets/)
- [Attackers spoofing OAuth client IDs to cloak Entra compromise attempts: Proofpoint](https://www.biometricupdate.com/202607/attackers-spoofing-oauth-client-ids-to-cloak-entra-compromise-attempts-proofpoint)
- [Microsoft Entra authentication & authorization error codes](https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2476