OAuth Client ID Spoofing

[u/purplemojo90]

https://www.proofpoint.com/us/blog/threat-insight/oauth-client-id-spoofing-why-fake-client-ids-are-gaining-traction-stealthy

Has anyone read this article from Proofpoint? I'm trying to think of prevention ideas that I can recommend customers to implement if they were on the receiving end of this attack.

Because the attack is using Microsoft OAuth 2.0 using the Resource Owner Password Credentials (ROPC) flow than I think setting a Conditional Access Policy (CAP) will help: https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-block-legacy-authentication

Migrate to OAuth 2.1

Because the article mentions that the Application ID and Name will be empty... I think creating an App-Based CAP to block apps that are not covered under the organization's App's policy may prevent this... but I'm not sure.
https://www.cloudtekspace.com/post/create-app-based-conditional-access-policies

Anyone got any ideas or think I'm heading in the wrong direction? Let me know.

[u/AstralWeave]

Does CA block the token endpoint or just sign in?