Loading story…
An open-source Python tool, ResetSpy, queries Microsoft Entra ID's Self-Service Password Reset (SSPR) portal to identify valid user accounts and infer the password-reset methods registered to them. It emulates browser requests to passwordreset.microsoftonline.com, obtains session-bound ASP.NET values, submits target email addresses, and interprets portal responses to classify accounts as MFA-enabled, lacking visible MFA, not found, SSPR-disabled, CAPTCHA-protected, or error states.
The exposed SSPR methods can approximate MFA posture where organizations use combined security-information registration, but the results omit FIDO2 keys, certificate-based authentication, guest or federated users, methods excluded by SSPR policy, and tenants with disabled SSPR. Because Entra ID applies stronger SSPR requirements to administrator accounts and may leave SSPR available for administrators when standard users are excluded, method-selection responses could also help identify privileged accounts. Organizations should limit SSPR exposure according to policy, review registration and administrator reset settings, and monitor anomalous SSPR portal enumeration activity.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
mlcsec published ResetSpy on GitHub, an open-source Python tool that probes Entra ID's SSPR portal to identify valid accounts and exposed password-reset verification methods.
Microsoft reportedly removed the legacy CAPTCHA from the Entra SSPR flow and replaced it with backend throttling and behavior-based abuse detection.
Microsoft Entra combined security-information registration became enabled by default, commonly registering methods for both SSPR and MFA through a single process.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcegithub.com
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that Microsoft Entra ID’s legacy WS-Trust autologon endpoint for Seamless SSO can be abused to conduct password-spraying attacks with reduced defensive visibility. Testing found the `usernamemixed` endpoint remained reachable for older Office 2013-era clients, did not appear to trigger expected Smart Lockout protections, and omitted failed attempts from standard Entra ID sign-in logs. The endpoint also returned distinct `AADSTS` error codes that let attackers distinguish invalid passwords from valid credentials that were later blocked by MFA or Conditional Access, enabling efficient credential validation without full account access. The activity aligns with ATT&CK techniques for **Password Spraying** and abuse of **Valid Accounts**, including default or legacy authentication paths that permit legitimate-looking logons once credentials are known. Defenders were advised to disable the WS-Trust `usernamemixed` endpoint, block legacy authentication through Conditional Access, monitor the Unified Audit Log for autologon requests, and use detections for repeated failed logons from a single IP across multiple users—similar to Okta analytics that flag more than five invalid authentication attempts from one source as suspicious spraying behavior.
Aug 12, 2026
Proofpoint reported that attackers are increasingly abusing **OAuth client ID spoofing** against Microsoft Entra ID to enumerate accounts and validate credentials without registering a legitimate OAuth application. The activity relies on Resource Owner Password Credentials (ROPC) authentication requests that use spoofed or random `client_id` values, allowing attackers to distinguish invalid usernames, valid usernames with incorrect passwords, and in some cases valid username-password pairs based on Microsoft Entra `AADSTS` error responses. Proofpoint said it observed at least two large-scale campaigns, **UNK_pyreq2323** and **UNK_OutFlareAZ**, using different infrastructure, user agents, and client ID generation patterns, indicating the technique is being adopted by multiple threat actors. Microsoft’s published Entra error code behavior helps explain how responses such as `AADSTS700016` can leak authentication state, and defenders were urged to review Entra sign-in logs for blank or missing application names or IDs and to treat some apparent failed logins as possible signs of successful credential validation by an attacker.
Aug 19, 2026
Splunk published attack simulation datasets showing two **Microsoft Entra ID** account-manipulation scenarios tied to MITRE ATT&CK `T1098`. In one case, an attacker changes an Azure AD guest account’s `UserType` from **Guest** to **Member**, removing the normal tenant-resource restrictions applied to guest identities and potentially expanding access for persistence. The dataset is based on Azure Audit logs and includes a benign user profile update that changes `MobilePhone` without modifying `UserType`, allowing defenders to test detection specificity. A second dataset models persistence through `T1098.001` by adding a **federated identity credential** to an Entra ID service principal. The simulated change establishes trust with an external **GitHub Actions OIDC** issuer and repository outside the tenant’s control, creating a path for unauthorized workload authentication. That dataset also includes a benign service principal update that changes only `DisplayName`, helping analysts distinguish malicious federated credential additions from routine administrative activity during replay and validation in Splunk environments.
Jul 13, 2026