CloudThe Hacker Newsabout 3 hours ago
OAuth Spoofing Bypasses Entra ID Telemetry
1 min read
Attackers are spoofing OAuth client IDs to validate stolen Microsoft Entra ID credentials without generating successful sign-in events. Proofpoint identified two campaigns, UNK_OutFlareAZ and UNK_pyreq2323, using this technique since December 2025. The method exploits different error responses to infer valid usernames and passwords while evading detection.
Level
Hype check
Tap to vote and see what everyone thinks.
In this storyMicrosoft
Summary by ByteBrief
