OAuth Token Theft Through Microsoft's Front Door | Huntress

A researcher demonstrates an end-to-end post-compromise technique where a sideloaded AppX package (requiring Developer Mode or an enterprise sideloading policy) grants remote JavaScript full WinRT access inside Microsoft-signed AppX hosts (proved on WWAHost.exe) to invoke WebAuthenticationBroker and capture real Microsoft OAuth authorization codes and refresh tokens (surviving MFA), provides a high-confidence network detection rule (MSAppHost/3.0 user agent to non-Microsoft hosts), and recommends immediate mitigations including disabling Developer Mode, deploying the proxy/SIEM rule, tightening Conditional Access and refresh-token lifetimes.