Loading story…
Researchers demonstrated a post-compromise technique that abuses sideloaded AppX packages and the Microsoft-signed WWAHost.exe Windows Web App Host process to steal Microsoft 365 OAuth tokens. On Windows devices where Developer Mode or enterprise sideloading is enabled, an unprivileged user can register an AppX manifest granting attacker-hosted JavaScript unrestricted Windows Runtime access through WindowsRuntimeAccess="all". The chain invokes the legacy WebAuthenticationBroker API to display a legitimate Microsoft sign-in and MFA prompt, intercepts the returned authorization code, and exchanges it for Microsoft 365 access and refresh tokens.
The technique was tested on Windows 11 24H2 against an MFA-protected Entra ID tenant and obtained broad delegated Microsoft Graph permissions using a Microsoft Office client ID. Defenders should investigate outbound connections using the legacy MSAppHost/3.0 user agent to non-Microsoft destinations, alongside AppX registration, manifest, and related endpoint telemetry. Recommended mitigations include restricting Developer Mode and enterprise sideloading, applying Conditional Access and Token Protection where available, enabling Continuous Access Evaluation, and reducing refresh-token persistence.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Huntress disclosed and demonstrated an OAuth token-theft technique in which a sideloaded AppX package uses Microsoft-signed WWAHost.exe and WebAuthenticationBroker to capture a victim's authorization code after legitimate Microsoft sign-in and MFA. The captured code can be exchanged for Microsoft 365 access and refresh tokens, with the latter reportedly reusable from another machine and network without a new MFA prompt.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are increasingly abusing **OAuth** in *Microsoft Entra ID* and *Microsoft 365* to obtain **access/refresh tokens** that provide durable access even when passwords are reset and MFA is enabled. Reported activity includes both (1) **malicious OAuth app** registrations and deceptive consent prompts that masquerade as legitimate “business integrations,” and (2) abuse of the **OAuth 2.0 Device Authorization Grant** (device code flow) where victims authenticate on Microsoft’s legitimate device login portal, making the intrusion harder to detect with credential-focused controls. Multiple reports describe campaigns targeting business users and organizations (including technology, manufacturing, and financial sectors) to access resources such as **Outlook, Teams, and OneDrive** and to enable mailbox actions and data access under seemingly legitimate application activity. Research and incident reporting highlight that attackers can persist via **service principals** created in victim tenants after consent is granted, and that some integrations may remain effective even if the consenting user is later disabled; separate reporting also describes **device-code vishing/phishing** that leverages legitimate Microsoft OAuth client IDs and standard login workflows to capture tokens without attacker-hosted phishing pages, with one source attributing the vishing activity to **ShinyHunters** (unconfirmed by Microsoft at the time of reporting).
Jun 29, 2026
Researchers and incident responders are warning that attackers are increasingly abusing Microsoft Entra ID's OAuth 2.0 **device code flow** to hijack Microsoft 365 accounts through legitimate sign-in prompts rather than malware or software exploits. In these attacks, victims are tricked via **vishing** or phishing into entering an attacker-supplied code at Microsoft's device login page and approving MFA, which issues the attacker valid access and refresh tokens. Security firms say the technique can provide broad access to services including **Microsoft Graph**, **Exchange Online**, **OneDrive**, and **SharePoint**, and that password resets alone may not fully contain the intrusion because refresh tokens can persist across services. The activity has been tied to data theft and follow-on abuse. ReliaQuest reported that the **Helix** extortion group used device code phishing, MFA abuse, and rogue authenticator registration to access victim Microsoft 365 tenants, enumerate SharePoint, and exfiltrate data before extortion; reported victims include Medtronic, Nissan, NAIC, Kodak, Infinite Campus, and the University of Nottingham. Separate investigations documented attackers signing in from foreign locations, registering multiple devices, creating hidden inbox rules to suppress replies, and using compromised mailboxes to send phishing messages at scale. Microsoft and security researchers recommend blocking or restricting device code authentication with **Conditional Access**, limiting SharePoint and device registration to managed devices, and monitoring Entra ID telemetry for `AuthenticationProtocol` set to device code, unusual travel, mailbox rule changes, and spikes in device registrations.
Jul 23, 2026
Researchers detailed how Microsoft nested app authentication (NAA), also called **BroCI**, can let an attacker who already holds a valid refresh token from a broker-capable Microsoft application exchange it for tokens to other apps and resources. The technique was shown against Azure and Entra ID workflows to retrieve Conditional Access Policy data, activate Privileged Identity Management roles, access Azure Key Vault secrets, and enumerate Intune devices by brokering requests through administrator portals. The write-up emphasized that MFA claims present in the original broker token can persist into downstream requests, potentially satisfying Conditional Access checks, and clarified that the method relies on **refresh tokens**, not access tokens. A separate offensive analysis showed that **VS Code Dev Tunnels** can be abused for remote access by using authenticated GitHub or Azure/Entra ID tokens to enumerate tunnels, obtain connect-scoped JWTs, establish WebSocket relay sessions, and invoke MsgPack-based RPC methods for command execution and file operations on tunnel hosts. The author said credentials stored by VS Code can still be recovered by same-user processes despite Electron `safeStorage`, and released a Rust proof-of-concept called **Ouroboros** to interact with existing tunnels. Together, the research highlights how token theft, device-code phishing, and Microsoft token pivoting techniques such as **FOCI/BroCI** can extend access across cloud administration surfaces and developer remote-access infrastructure.
Jul 24, 2026