Intercepted: How Hackers Take On the Cloud

Show notes

Hello to our Cyber Pals!

This week, Selena hands the mic over to a recording of Proofpoint's Intercepted webinar — a monthly video series she co-hosts with Sarah Sabotka — for a deep dive into how cloud brute force attacks are quietly getting more sophisticated. Joining Sarah and webinar host Jason is Rachel Rabin, a threat researcher on Proofpoint's Cloud Threat Research Team, to unpack two spoofing techniques she's seen increasingly weaponized against Microsoft Entra ID environments.

Rachel opens with the state of brute forcing today: despite flashier techniques like device code phishing and MFA-resistant phishing kits, brute force remains the most common identity attack vector, with 99% of tenants experiencing some form of it in 2026 — even though success rates typically sit well under 1%. She walks through why first-party Microsoft apps like Azure CLI and Azure AD PowerShell remain the most heavily targeted (publicly known client IDs, gaps in MFA enforcement, and pre-consented scopes), and why the legacy ROPC authentication flow makes credential testing so convenient for attackers.

From there, Rachel breaks down two techniques that "level up" traditional brute forcing:

User agent spoofing, illustrated by a campaign (later tracked as UNK_CustomCloak) that hit Windows Live Custom Domains — a legacy, discontinued Microsoft app — impacting half a million users across 4,000 tenants using over 600,000 IP addresses and a staggering 7.4 million unique, machine-generated user agent strings.
OAuth client ID spoofing, a newer and stealthier technique where attackers submit a syntactically valid but fake client ID to infer whether a password is correct from Entra's error codes, without ever generating a successful sign-in event that would normally tip off defenders. Rachel compares two real-world campaigns (UNK_pyreq2323 and UNK_OutFlareAZ) that appear to have arrived at the technique independently.

Sarah, Jason, and the live chat also dig into:

Why over-engineering a spoofed user agent can make an attacker easier to spot, not harder
How conditional access policies scoped to the wrong signal (like operating system) can be silently bypassed by a spoofed user agent
Why a failed sign-in shouldn't be dismissed as a non-event. It can still mean a credential has been validated
Rachel's practical, "lowest hanging fruit" recommendations: MFA, blocking legacy authentication, layered conditional access, smart lockout policies, and the shift toward passkeys

Plus: a shoutout to next month's session on fraud and job scams ahead of Cybersecurity Awareness Month.

Resources Mentioned:

OAuth Client ID Spoofing: Why Fake Client IDs Are Gaining Traction for Stealthy Enumeration — Proofpoint

← Previous

Half-Click is so Hot Right Now: How Russian and Chinese Attackers Exploit Mailservers

Send us fan mail! Hello to our Cyber Pals! This week, Selena hands the mic over to a recording of Proofpoint's Intercepted webinar — a monthly video series she co-hosts with Sarah Sabotka — for a deep dive into how cloud brute force attacks are quietly getting more sophisticated. Joining Sarah and webinar host Jason is Rachel Rabin, a threat researcher on Proofpoint's Cloud Threat Research Team, to unpack two spoofing techniques she's seen increasingly weaponized against Microsoft Entra ID environments. Rachel opens with the state of brute forcing today: despite flashier techniques like device code phishing and MFA-resistant phishing kits, brute force remains the most common identity attack vector, with 99% of tenants experiencing some form of it in 2026 — even though success rates typically sit well under 1%. She walks through why first-party Microsoft apps like Azure CLI and Azure AD PowerShell remain the most heavily targeted (publicly known client IDs, gaps in MFA enforcement, and pre-consented scopes), and why the legacy ROPC authentication flow makes credential testing so convenient for attackers. From there, Rachel breaks down two techniques that "level up" traditional brute forcing: User agent spoofing, illustrated by a campaign (later tracked as UNK_CustomCloak) that hit Windows Live Custom Domains — a legacy, discontinued Microsoft app — impacting half a million users across 4,000 tenants using over 600,000 IP addresses and a staggering 7.4 million unique, machine-generated user agent strings. OAuth client ID spoofing, a newer and stealthier technique where attackers submit a syntactically valid but fake client ID to infer whether a password is correct from Entra's error codes, without ever generating a successful sign-in event that would normally tip off defenders. Rachel compares two real-world campaigns (UNK_pyreq2323 and UNK_OutFlareAZ) that appear to have arrived at the technique independently. Sarah, Jason, and the live chat also dig into: Why over-engineering a spoofed user agent can make an attacker easier to spot, not harder How conditional access policies scoped to the wrong signal (like operating system) can be silently bypassed by a spoofed user agent Why a failed sign-in shouldn't be dismissed as a non-event. It can still mean a credential has been validated Rachel's practical, "lowest hanging fruit" recommendations: MFA, blocking legacy authentication, layered conditional access, smart lockout policies, and the shift toward passkeys Plus: a shoutout to next month's session on fraud and job scams ahead of Cybersecurity Awareness Month. Resources Mentioned: OAuth Client ID Spoofing: Why Fake Client IDs Are Gaining Traction for Stealthy Enumeration — Proofpoint