Overview
- Proofpoint published its findings Monday after reproducing a method that sends POST requests to Microsoft’s OAuth 2.0 token endpoint using the Resource Owner Password Credentials (ROPC) flow to test usernames and passwords.
- Entra returns distinct AADSTS error codes that reveal account state: AADSTS50034 for unknown users, AADSTS50126 for valid user with wrong password, and AADSTS700016 when valid credentials are supplied to an unregistered client ID.
- Researchers tracked multiple large campaigns, including UNK_pyreq2323 and UNK_OutFlareAZ, that used hundreds of thousands to millions of spoofed client IDs and reached more than one million and more than two million user accounts respectively across thousands of tenants.
- Spoofed client IDs often leave the application name blank in Entra sign-in logs, which can bypass detections keyed to app names and prevent Conditional Access policies scoped to known apps from applying, so defenders should flag blank app-name entries and AADSTS700016 responses as suspicious.
- Proofpoint warns the technique can spread to other identity providers, it caused mass account lockouts in one campaign that affected about 28% of touched users, and organizations should review sign-in telemetry, error codes, request volume, and unusual source infrastructure to protect users.