OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials

Two threat actor groups are using OAuth client ID spoofing to validate stolen Microsoft Entra credentials without triggering sign-in alerts. Attackers enumerate valid usernames and test passwords at scale while remaining invisible to standard telemetry. Millions of users across thousands of tenants are potentially affected.