Since December 2025, at least two threat campaigns have generated more than 4 million fabricated application identities to enumerate accounts in Microsoft Entra ID without ever completing a login, according to a new report published by Proofpoint and covered by CSO Online. The campaigns exploited OAuth client ID spoofing—a technique that defeats traditional per-application volume thresholds by rotating or fabricating the client identifier field itself—to validate user credentials while appearing to security teams as routine configuration debris rather than coordinated attacks.
The first campaign, tracked as UNK_pyreq2323, operated from AWS infrastructure and mutated the trailing digits of a legitimate Exchange Online application ID across more than 700,000 variations, reusing each one against no more than a dozen accounts before discarding it. That campaign targeted over a million users across roughly 4,000 tenants, with approximately 28 percent of affected accounts hitting lockout. The second campaign, UNK_OutFlareAZ, ran mostly through Cloudflare and generated a fresh random UUID per request—3.7 million spoofed IDs against more than two million accounts, peaking near 720,000 targeted users on March 15, 2026. Proofpoint researchers cannot yet confirm whether this represents one actor or two independent clusters converging on the same technique.
Both campaigns abuse the OAuth 2.0 Resource Owner Password Credentials flow, in which a single token request bundles a username, password, and client ID. Three Entra ID response codes carry the operational signal: AADSTS50034 indicates the username doesn't exist, AADSTS50126 means the username exists but the password is incorrect, and AADSTS700016 fires when both username and password are valid but the client ID isn't recognized. The report notes that the last code, AADSTS700016, "on its own, it looks like an app-registration problem an admin forgot to clean up," but when paired with an unfamiliar, constantly rotating client ID, it can signal an attacker has already confirmed a working credential pair and is one step away from account takeover.
The detection gap isn't cosmetic. A 28 percent lockout rate across a million-user campaign translates to helpdesk costs, productivity hits, and—for every account where AADSTS700016 fired before the lockout—a live credential an attacker has already validated and can use elsewhere for mailbox access, OAuth consent grants, or lateral movement into connected SaaS. The report emphasizes that effective detection logic must correlate client ID cardinality, missing application names, and AADSTS error sequences across a time window, not any single event, because attackers are fragmenting their traffic across disposable identifiers that per-application volume thresholds never catch. ROPC persists in more environments than security teams expect—in legacy scripts, CI pipelines, and third-party integrations built before Microsoft's guidance to avoid it—precisely because it remains the path of least resistance for developers who never need to open a browser, and that installed base is what gives the technique room to operate.
The report recommends retiring ROPC entirely, migrating interactive apps to browser-based authentication and service workloads to managed identities or certificate-based service principals, to remove the flow this technique depends on. Until that migration is complete, detection rules that track distinct client IDs and the presence of AADSTS700016 within the same window are what stand between a ticket closed as configuration noise and a caught account-takeover attempt. The broader lesson for detection engineers: any field a defender logs but doesn't correlate—application ID, user agent, ASN—is a candidate for an attacker to fragment their traffic across until per-field thresholds stop tripping. Organizations that wait to act on this pattern may discover the gap not through an alert, but through a fraudulent wire request weeks after the credential was validated. The cost of legacy authentication flows is no longer hypothetical when adversaries are industrializing enumeration at this scale, and security architectures built on static thresholds will continue to miss coordinated campaigns that look like noise until correlation becomes the default.