Loading story…
Proofpoint reported that attackers are increasingly abusing OAuth client ID spoofing against Microsoft Entra ID to enumerate accounts and validate credentials without registering a legitimate OAuth application. The activity relies on Resource Owner Password Credentials (ROPC) authentication requests that use spoofed or random client_id values, allowing attackers to distinguish invalid usernames, valid usernames with incorrect passwords, and in some cases valid username-password pairs based on Microsoft Entra AADSTS error responses.
Proofpoint said it observed at least two large-scale campaigns, UNK_pyreq2323 and UNK_OutFlareAZ, using different infrastructure, user agents, and client ID generation patterns, indicating the technique is being adopted by multiple threat actors. Microsoft’s published Entra error code behavior helps explain how responses such as AADSTS700016 can leak authentication state, and defenders were urged to review Entra sign-in logs for blank or missing application names or IDs and to treat some apparent failed logins as possible signs of successful credential validation by an attacker.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Proofpoint reported that attackers are increasingly abusing spoofed or random OAuth client_id values in ROPC authentication requests against Microsoft Entra ID to enumerate accounts and infer credential validity without registering an OAuth application. The company said it observed at least two large-scale campaigns, tracked as UNK_pyreq2323 and UNK_OutFlareAZ, indicating multiple threat actors have adopted the technique.
Microsoft published documentation for Microsoft Entra authentication and authorization error codes, including AADSTS responses that can reveal differences between invalid usernames, bad passwords, and other authentication states.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
13 references tracked. Mallory keeps watching after this page renders.
csoonline.com
Open sourcesecurityonline.info
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourceproofpoint.com
Open sourcelearn.microsoft.com
Open sourcelearn.microsoft.com
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are increasingly abusing **OAuth** in *Microsoft Entra ID* and *Microsoft 365* to obtain **access/refresh tokens** that provide durable access even when passwords are reset and MFA is enabled. Reported activity includes both (1) **malicious OAuth app** registrations and deceptive consent prompts that masquerade as legitimate “business integrations,” and (2) abuse of the **OAuth 2.0 Device Authorization Grant** (device code flow) where victims authenticate on Microsoft’s legitimate device login portal, making the intrusion harder to detect with credential-focused controls. Multiple reports describe campaigns targeting business users and organizations (including technology, manufacturing, and financial sectors) to access resources such as **Outlook, Teams, and OneDrive** and to enable mailbox actions and data access under seemingly legitimate application activity. Research and incident reporting highlight that attackers can persist via **service principals** created in victim tenants after consent is granted, and that some integrations may remain effective even if the consenting user is later disabled; separate reporting also describes **device-code vishing/phishing** that leverages legitimate Microsoft OAuth client IDs and standard login workflows to capture tokens without attacker-hosted phishing pages, with one source attributing the vishing activity to **ShinyHunters** (unconfirmed by Microsoft at the time of reporting).
Jun 29, 2026
Researchers reported that Microsoft Entra ID’s legacy WS-Trust autologon endpoint for Seamless SSO can be abused to conduct password-spraying attacks with reduced defensive visibility. Testing found the `usernamemixed` endpoint remained reachable for older Office 2013-era clients, did not appear to trigger expected Smart Lockout protections, and omitted failed attempts from standard Entra ID sign-in logs. The endpoint also returned distinct `AADSTS` error codes that let attackers distinguish invalid passwords from valid credentials that were later blocked by MFA or Conditional Access, enabling efficient credential validation without full account access. The activity aligns with ATT&CK techniques for **Password Spraying** and abuse of **Valid Accounts**, including default or legacy authentication paths that permit legitimate-looking logons once credentials are known. Defenders were advised to disable the WS-Trust `usernamemixed` endpoint, block legacy authentication through Conditional Access, monitor the Unified Audit Log for autologon requests, and use detections for repeated failed logons from a single IP across multiple users—similar to Okta analytics that flag more than five invalid authentication attempts from one source as suspicious spraying behavior.
Aug 12, 2026
A new phishing technique called **ConsentFix** has emerged, targeting Microsoft Entra ID by abusing legitimate OAuth 2.0 authorization flows. Attackers craft malicious login URLs and use social engineering tactics—such as fake CAPTCHAs or error messages—to trick users into providing OAuth authorization codes. These codes are then exchanged for access and refresh tokens, granting attackers programmatic access to Microsoft accounts and cloud resources, all without stealing credentials or triggering multi-factor authentication (MFA) prompts. The attack is an evolution of previous consent phishing and ClickFix-style methods, with recent variants making the process even easier for victims through drag-and-drop functionality. ConsentFix is particularly dangerous because it bypasses Conditional Access policies and device compliance requirements, undermining otherwise robust security frameworks. Detection and response require visibility into identity, SaaS, and cloud activity, as traditional prevention mechanisms are ineffective. Security teams are advised to monitor Azure sign-in logs for unusual authentication events and to educate users about the risks of interacting with suspicious login flows or error messages that request manual actions like copying and pasting URLs. The attack highlights the ongoing evolution of phishing tactics targeting cloud authentication systems and the need for advanced monitoring and user awareness.
Jun 29, 2026