Microsoft 365, Entra ID, and OAuth abuse remain a top initial-access channel

Identity abuse is one of the clearest operational threats in the feed, especially around Microsoft 365 and Entra ID. Attackers are using fake passkey enrollment, device-code flow abuse, OAuth client ID spoofing, malicious guest accounts, and consent tricks to evade detection and harvest credentials. These techniques matter because they often generate weak telemetry or no successful sign-in event, which makes traditional SOC triage unreliable. Several stories also show social engineering being paired with technical abuse, including vishing and help-desk impersonation. For enterprises, this means MFA is necessary but not sufficient unless the factor and enrollment process are resistant to social manipulation and token theft. The trend is especially relevant for banks and public-sector organizations that rely heavily on Microsoft identity services. In practical terms, identity security is now an operational discipline, not just an IAM configuration problem.

Sources

• OAuth client ID spoofing: Why fake client IDs are gaining traction for stealthy enumeration — Proofpoint Threat Insight
• Extortion crew hijacks Microsoft 365 accounts via fake passkey setup — Help Net Security
• Defending SaaS-based applications against ShinyHunters OAuth abuse — Microsoft Security Blog