Executive Summary
Multiple threat actors, including the campaigns tracked as UNK_pyreq2323 and UNK_OutFlareAZ, are increasingly utilizing OAuth client ID spoofing to bypass traditional identity monitoring in Microsoft Entra environments. By supplying valid-looking but unregistered Application IDs during the Resource Owner Password Credentials (ROPC) flow, attackers can infer the validity of usernames and passwords based on specific Entra error codes.
This technique is particularly dangerous because it results in blank 'Application Name' fields in Entra sign-in logs, effectively evading security detections that rely on application-specific volume surges or Conditional Access policies. Proofpoint observed millions of spoofed IDs targeting over two million users, with some campaigns resulting in significant account lockouts across thousands of organizations. This represents a mature shift in cloud-based reconnaissance tradecraft designed to identify valid credentials before attempting an actual login.