WAM BAM - Recovering Web Tokens From Office

This blog post details how Microsoft Office obtains and caches MSA and Azure AD authentication tokens, showing two recovery methods: calling wlidsvc RPC (e.g., WLIDAcquireTokensWithNGC) to obtain passport tokens for MSA, and locating/decrypting TokenBroker cache files (%LOCALAPPDATA%\Microsoft\TokenBroker\Cache) where Azure/other tokens are serialized and protected with DPAPI. The author provides reversing notes, WinDbg/Ghidra evidence, and proof-of-concept tools (WAMBam) to recover usable JWTs without memory scraping.