T1071.001

OAuth Token Theft Through Microsoft’s Front Door | Huntress

Huntress describes a proof-of-concept attack in which a sideloaded AppX package uses WWAHost.exe and WindowsRuntimeAccess="all" to run attacker-controlled JavaScript and invoke a…

Sep 23, 2026