Spoofed OAuth client IDs blind Entra logs
from Crestvale Newsroom Hosted by Crestvale Newsroom
Send us Fan Mail Identity signals are getting harder to trust. Attackers are now spoofing OAuth client IDs in Microsoft Entra ID, which means sign-in logs can misattribute the source of authentication attempts. At the same time, real-world attacks are shifting into places many teams do not continuously monitor, including browser runtime and third-party code. For security leaders, this changes how detection needs to work. Logs are no longer clean ground truth, and vendor trust cannot be static. Teams need to focus on behavior, anomaly patterns, and continuous visibility across identity systems and frontend execution. This episode also covers pre-disclosure exploitation of SonicWall SMA zero days, a browser-layer supply chain attack that led to a three million dollar loss, and AWS expanding Security Hub into a multi-cloud control plane. Learn more at https://crestvale.io Support the show
Embed this episode
What this episode covers
Send us Fan Mail Identity signals are getting harder to trust. Attackers are now spoofing OAuth client IDs in Microsoft Entra ID, which means sign-in logs can misattribute the source of authentication attempts. At the same time, real-world attacks are shifting into places many teams do not continuously monitor, including browser runtime and third-party code. For security leaders, this changes how detection needs to work. Logs are no longer clean ground truth, and vendor trust cannot be stati...
No transcript yet.