OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials

Proofpoint published a series of mid-2026 advisories and news items highlighting an increase in identity- and phishing-focused attacks and related defensive moves. Key incidents include OAuth client‑ID spoofing techniques that let attackers validate stolen Microsoft Entra credentials, new stealth methods to harvest Entra user data, device‑code phishing, and expansion of China‑linked TA4922 phishing campaigns into the UK, Germany, Italy, and South Africa. Other notable items: suspected Chinese actors targeting university Roundcube mailservers, suspected North Korean groups using fake coding‑job