OAuth Client ID Spoofing: A New Cloud Attack Vector
Attackers have a new trick up their sleeves, and it’s aimed squarely at cloud environments. Cybersecurity researchers at Proofpoint have uncovered a technique they call OAuth client ID spoofing, which lets bad actors slip past standard defenses and into enterprise cloud accounts.
The method abuses Microsoft Entra ID — the cloud identity service formerly called Azure AD. By spoofing client IDs, attackers can authenticate without ever registering a legitimate application. That means the activity often goes unnoticed until it’s too late.
Proofpoint detailed the findings in a blog post published July 13, warning that this is no isolated incident. The firm says it has tracked multiple large-scale campaigns abusing the technique, targeting millions of accounts across thousands of Microsoft Entra tenants.
How the Client ID Spoofing Attack Works
The attack hinges on a specific OAuth 2.0 flow called Resource Owner Password Credentials (ROPC). In this flow, the attacker sends POST requests directly to Microsoft’s token endpoint, submitting usernames and passwords in one go.
What makes it clever is the response. The Azure Active Directory Security Token Service (AADSTS) returns error codes that reveal whether a username is valid, whether a password is correct, and whether additional controls like multi-factor authentication (MFA) or conditional access policies are enforced.
Armed with that intel, attackers can zero in on accounts that are ripe for exploitation. And because the spoofed client ID shows up as blank in Entra sign-in logs, defenders often have no idea anything is wrong.
The Role of Common Usernames
Proofpoint’s research shows attackers aren’t just guessing randomly. They’re spoofing usernames that combine initials with common surnames — Smith, Jones, Williams, Johnson. That yields logins like jsmith, ajohnson, or awilliams.
Why bother? Because these usernames are both widespread and rarely changed. Organizations rarely force users to adopt more complex login IDs, so attackers can bank on a decent hit rate.
Why Traditional Defenses Fall Short
Most security teams rely on Entra sign-in logs to spot malicious authentication activity. User enumeration, for example, is typically caught this way. But client ID spoofing throws a wrench into that strategy.
The logs show blank application IDs or no application name at all. That’s a red flag in theory, but in practice, it’s easy to overlook amid the noise of legitimate traffic. Attackers are counting on that.
Proofpoint warns that the technique is gaining traction. “The emergence of multiple campaigns with unique tools and infrastructure suggests this technique is gaining traction among threat actors targeting cloud environments,” the blog post states.
Indicators of Compromise and How to Respond
So what should defenders watch for? Proofpoint offers a few concrete signs:
- Blank application IDs in sign-in logs, or entries with no corresponding application name — treat these as potential spoofing attempts.
- AADSTS700016 error codes — this specific error may indicate compromised credentials, not just a failed login. Don’t brush it off.
- Unusual ROPC flow activity — if you see token requests using password credentials where you don’t expect them, investigate.
The key takeaway: don’t assume a failed login is harmless. The error code itself can be a breadcrumb leading to a much bigger problem.
What This Means for Cloud Security Teams
This attack is a reminder that cloud identity systems are only as strong as their weakest link. OAuth flows are designed for convenience, but that convenience can be weaponized.
Defenders should consider tightening conditional access policies, enforcing MFA wherever possible, and reviewing sign-in logs for anomalies — especially blank application fields. It’s also worth auditing which OAuth applications are registered in your tenant and whether any legitimate app would ever use the ROPC flow.
For more on related threats, check out our guide on cloud identity and access management security and how to spot phishing attacks targeting Microsoft 365. Understanding these attack patterns is the first step in staying ahead of them.
The bottom line? OAuth client ID spoofing is a real, active threat. It’s stealthy, it’s effective, and it’s only going to get more common. Start looking at your logs differently — before an attacker does it for you.
