OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials

Attackers are using a technique called OAuth client ID spoofing to validate stolen Microsoft Entra credentials without triggering alerts. This method allows them to enumerate user accounts and verify stolen credentials in Microsoft Entra ID environments. The technique is effective in evading detection, as it does not generate a successful sign-in event. At least two distinct threat actors are utilizing this novel evasion technique in cloud campaigns. The attackers are able to slip past telemetry, remaining undetected. This technique is being used to weaponize cloud campaigns.