Proofpoint reports that it has detected a new evasion technique in large-scale campaigns against Microsoft Entra, a product designed to manage identities and access in the cloud. The investigation reveals that OAuth client identifier spoofing has been abused by attackers to bypass traditional application-based detection mechanisms.
Cybercriminals are able to validate usernames, check the status of accounts, deduce the validity of passwords, or see if protection measures, such as multi-factor authentication or conditional access policies, are active, without needing to complete a successful login, and by taking advantage of the behavior of the Microsoft Entra authentication service. By using spoofed client IDs instead of registered OAuth applications, attackers cause authentication logs to appear without an associated application name, making it difficult for security teams to correlate malicious activity.
New attack methodologies for cloud environments
Proofpoint has identified two particularly relevant campaigns that demonstrate the rapid adoption of this technique. The first, UNK_PyReq2323, has used more than 700,000 spoofed customer IDs from AWS infrastructure to target more than one million accounts in nearly 4,000 Microsoft Entra tenants. The second, UNK_OutFlareAZ, has increased the sophistication of the attack through 3.7 million random and unique OAuth identifiers, affecting more than two million users from the Cloudflare infrastructure.
By spoofing OAuth client IDs, attackers can hide credential recognition and validation activities
Although both campaigns took advantage of different infrastructures, tools and methods to generate counterfeit identifiers, experts affirm that it is an independent adoption of the same technique, which shows that this procedure is becoming a regular part of the arsenal of cybercriminals who attack cloud environments.
“This simultaneous appearance of campaigns that exploit the same technique demonstrates that attacks against identity platforms are evolving towards more stealthy and difficult methods in terms of detection,” they say from Proofpoint. “By spoofing OAuth client IDs, and by removing one of the main indicators for security teams, such as the application name, attackers are able to hide credential recognition and validation activities that, until now, had been easy to identify.”
Given these changes, Proofpoint recommends that organizations review Microsoft Sign in logs for events that lack an application name or have empty application identifiers, as these may be an indicator of impersonation. It is also recommended to update the correlation rules of SIEM systems to detect distributed authentication patterns that do not depend exclusively on the name of the application used, in addition to analyzing in detail AADSTS error codes, which can reveal credential validation attempts even when there is no login.
