UNK_CustomCloak
Unknown Active
- Mentions
- 1
- First seen
- 14 Jul 2026
- Last seen
- 14 Jul 2026
Relevant to you · Affects your stack
- Technology:
- Microsoft Entra ID
Origin
Unattributed
Profile
UNK_CustomCloak uses OAuth Client ID spoofing to validate stolen Microsoft Entra credentials. This technique enables attackers to take over compromised accounts. No further details are known about this actor.
Affected vendors
Microsoft