OAuth client ID spoofing in Entra ID: an attack that conceals credential validation

Colleagues, I’d like to flag an important cybersecurity development.

Attackers are abusing OAuth client ID spoofing in Microsoft Entra ID to test stolen usernames and passwords without ever completing a successful sign-in.

The issue is that Entra returns different errors depending on the client_id. Based on AADSTS responses, attackers can tell whether an account exists and whether the password is valid.

At the same time, application names may be absent from the logs, which means some detections and sign-in-based checks simply do not trigger.

Why this matters: this technique makes brute-force activity harder to spot and helps attackers bypass familiar defensive controls.

Do you think your monitoring rules are ready for this scenario?

#cybersecurity #MicrosoftEntra #CloudSecurity #IdentitySecurity