OAuth Client ID Spoofing: Why Fake Client IDs Are Gaining Traction for Stealthy Enumeration

MITRE Techniques

• [T1580 ] Cloud Infrastructure Discovery – Attackers leveraged cloud authentication behavior in Microsoft Entra ID and used AWS/Cloudflare-hosted infrastructure to conduct large-scale campaigns (‘originated from AWS infrastructure’ / ‘originating primarily from Cloudflare infrastructure’).
• [T1110.001 ] Password Guessing – The campaigns used authentication attempts to infer whether usernames and passwords were valid (‘infer the validity of usernames and passwords’ / ‘returned for a valid username with an invalid password’).
• [T1110.003 ] Password Spraying – Attackers distributed authentication attempts across many accounts and tenants to avoid obvious detection (‘targeted over one million unique user accounts across nearly 4,000 tenants’ / ‘precompiled username wordlists’).
• [T1589.003 ] Email Account – User Enumeration – The technique enabled enumeration of valid accounts without successful sign-ins (‘enumerate your entire organization’s accounts without generating a single successful sign-in event’ / ‘identify valid accounts and passwords’).
• [T1133 ] External Remote Services – Attackers abused Microsoft Entra ID authentication endpoints as an external access path (‘issuing POST requests to Microsoft’s OAuth 2.0 token endpoint’).
• [T1078 ] Valid Accounts – The activity was used to identify valid username-password pairs that could support later account compromise (‘facilitates enumeration of valid username-password pairs’).
• [T1566 ] Phishing – The article does not describe phishing directly, but the credential-validation workflow can support account compromise often associated with follow-on social engineering (‘infer both password and account validity’).