OAuth Token Theft Through Microsoft's Front Door | Huntress
Huntress details a WWAHost.exe AppX sideloading technique that presents Microsoft's real OAuth login and harvests tokens that survive MFA.
Huntress research shows a sideloaded AppX package with WindowsRuntimeAccess="all" can run attacker JavaScript inside Microsoft-signed WWAHost.exe with full WinRT access, including the legacy WebAuthenticationBroker API. Calling the broker with Microsoft Office's first-party client ID (d590ed36-52b3-4102-aeff-aad2292ab01c) and an OOB redirect URI opens a genuine login.microsoftonline.com dialog with no browser or address bar, and the returned access and refresh tokens reach the attacker's listener even after correct MFA. The chain was demonstrated on Windows 11 24H2 and requires Developer Mode or an enterprise AllowAllTrustedApps sideloading policy, with no further admin, UAC, or code signing needed.
- Abuses Microsoft-signed WWAHost.exe to render attacker JavaScript with full WinRT access
- Real Microsoft login dialog means no phishing indicators and tokens survive MFA
- Primary prerequisite is Developer Mode or AllowAllTrustedApps enterprise sideloading policy
- Attack surface concentrated on dev machines, CI runners, and GPO-managed fleets
From the original article
13 min read at huntress.comA sideloaded package turns a Microsoft-signed binary into an OAuth token theft tool. No phishing domain, no spoofed UI, no browser. Here's how to detect it.
huntress.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.