VTA-000189 – OAuth Client ID Spoofing Enables Silent Account Enumeration in Microsoft Entra ID Environments

Researchers have identified a growing attack technique where threat actors abuse spoofed OAuth client IDs to perform large-scale account enumeration and credential validation against Microsoft Entra ID while reducing detection opportunities.

The attack abuses Microsoft’s OAuth token endpoint by submitting authentication requests with fake or randomized OAuth client IDs. Instead of requiring a legitimate registered application, attackers rely on different authentication error responses to determine whether a username exists, whether a password is correct, or whether security controls such as multi-factor authentication are enforced. In some cases, valid credentials can be identified without generating a successful sign-in event.

Researchers observed multiple campaigns using different infrastructures and tooling, indicating that several threat actors have independently adopted the technique. Some campaigns reused modified versions of known application IDs, while others generated unique random UUIDs for every authentication request, making activity more difficult to correlate. Attackers also distributed requests across millions of spoofed application identifiers, reducing the effectiveness of detections based on application names or per-application rate limiting.

Since spoofed client IDs often leave the application name field empty in Entra ID sign-in logs, traditional monitoring rules may overlook these attacks. Researchers warn that organizations should treat blank application fields and specific authentication error codes as potential indicators of OAuth client ID spoofing and credential enumeration attempts.

Severity:

Medium

Attack Surface:

Cloud Service, Office 365

Tactics:

Credential Access, Discovery, Defense Evasion, Reconnaissance, Initial Access

Techniques:

T1589 – Gather Victim Identity Information

T1110 – Brute Force

T1078 – Valid Accounts

T1550 – Use Alternate Authentication Material

T1562 – Impair Defenses

T1110.003 – Password Spraying

T1589.001 – Gather Victim Identity Information: Credentials

T1580 – Cloud Infrastructure Discovery

T1528 – Steal Application Access Token

References:

1. https://www.proofpoint.com/us/blog/threat-insight/oauth-client-id-spoofing-why-fake-client-ids-are-gaining-traction-stealthy

SuperPRO’s Threat Countermeasures Procedures:

1. Monitor Entra ID sign-in logs for authentication events where the application name field is blank or null, which indicates spoofed OAuth client IDs are being used for enumeration attempts.

2. Implement tenant-level rate limiting for authentication requests rather than per-application limits to detect distributed enumeration campaigns that fragment activity across many spoofed client identifiers.

3. Configure SIEM alerts to detect AADSTS700016 error codes in authentication logs, as this specific response indicates valid username-password pairs were identified using spoofed application identifiers.

4. Review sign-in logs for surges in AADSTS50126 errors without corresponding application names, which signal password validation attempts against valid accounts using fabricated client IDs.

5. Disable the Resource Owner Password Credentials flow in Entra ID where not required, as this OAuth flow enables direct credential submission that attackers exploit for client ID spoofing enumeration.

6. Implement alerting for authentication requests originating from cloud infrastructure providers like AWS when the application ID does not match any registered enterprise application.

7. Correlate failed authentication events by source IP and user agent even when application names differ, as attackers distribute spoofed client ID attempts across hundreds of thousands of fictional applications to evade per-application detection thresholds.

Contributed by: Fatini