The Quiet Threat Hiding in Plain Sight
At least two distinct threat actors are now weaponizing a novel evasion technique called OAuth client ID spoofing in cloud campaigns, and they’re slipping past telemetry while doing it. This isn’t a theoretical flaw or a researcher’s proof-of-concept. It’s active, in the wild, and it’s giving attackers a way to poke at Microsoft Entra ID environments without leaving the usual digital footprints.
The core trick? It lets attackers enumerate user accounts and validate stolen credentials in Microsoft Entra ID environments without ever generating a successful sign-in event. That’s the kind of thing that keeps security teams up at night, because the very logs they rely on — the sign-in logs, the anomaly detection, the risk scoring — simply never fire.
How OAuth Client ID Spoofing Works
OAuth is the backbone of modern identity federation. When an app wants to access resources on behalf of a user, it presents a client ID and requests a token. The client ID is supposed to identify the application making the request. But what happens when an attacker crafts a request that looks like it’s coming from a legitimate, trusted application?
That’s the essence of the spoof. By manipulating the OAuth flow, attackers can trick the identity provider into processing authentication attempts as if they came from a benign client. The result: the system validates the credentials — checking whether a username and password pair is correct — but never completes a full sign-in, so no successful sign-in event is logged.
The Two-Stage Attack Chain
Researchers who tracked the activity describe a two-stage process that’s both simple and effective:
- Stage one: Account enumeration. The attacker sends a series of OAuth requests with spoofed client IDs to determine which usernames exist in the tenant. Each response reveals whether the account is valid, without triggering any lockout or alert.
- Stage two: Credential validation. Once valid usernames are identified, the attacker runs stolen password lists through the same spoofed OAuth flow. A successful response confirms the credentials are good — again, with no sign-in log entry to raise suspicion.
This two-step approach means attackers can quietly build a list of valid accounts and verified passwords, then use that intel for later, more damaging attacks — like data exfiltration or lateral movement.
Why Traditional Defenses Miss It
Most identity protection tools rely heavily on sign-in logs to detect anomalous behavior. Failed sign-ins, impossible travel, unusual locations — these are the bread and butter of threat detection. But if the attack never produces a sign-in event, those tools have nothing to chew on.
That’s the real danger here. The technique was designed to evade telemetry, and it does so effectively. Security information and event management (SIEM) systems, cloud access security brokers (CASBs), and even Microsoft’s own conditional access policies can be blindsided if they’re not specifically looking for this pattern of OAuth traffic.
What This Means for Security Teams
If you’re responsible for a Microsoft Entra ID tenant, this isn’t a time for panic — it’s a time for action. There are concrete steps you can take to reduce your exposure:
- Audit your OAuth applications. Review every application registered in your tenant. Remove any that are unused, and scrutinize any with broad permissions.
- Monitor OAuth traffic specifically. Don’t rely solely on sign-in logs. Look for patterns in token requests, especially from unfamiliar client IDs.
- Enable conditional access policies. Restrict which applications can request tokens, and require step-up authentication for sensitive operations.
- Watch for enumeration patterns. A sudden spike in OAuth requests, even if they’re not successful sign-ins, can be an early indicator of this technique.
It’s also worth revisiting your incident response playbook. If an attacker has already validated credentials, the clock is ticking. You need a process for detecting and responding to this kind of quiet reconnaissance before it escalates.
The Bigger Picture: Cloud Identity Security
This discovery is a reminder that identity is the new perimeter — and that the perimeter is getting harder to defend. Attackers are constantly finding new ways to abuse the protocols we trust, and OAuth is no exception. The same flexibility that makes OAuth powerful also makes it a target.
For organizations using Microsoft Entra ID, the takeaway is clear: you can’t rely on default logging alone. You need to understand the full range of OAuth flows in your environment, and you need tooling that can detect anomalies in those flows, not just in sign-in events.
As for the threat actors behind this campaign, researchers are still tracking them. But the fact that at least two distinct groups have adopted the technique suggests it’s not a one-off. It’s a playbook, and it’s likely to spread.
The best defense is awareness — and a healthy skepticism about what your logs are actually telling you. Because sometimes, the absence of an alert is the alert.
