Microsoft Office

MITRE ATT&CK

T1071.0011 shared article T11051 shared article T11331 shared article T12181 shared article T12191 shared article T15281 shared article T16471 shared article

Vendors

Microsoft1 shared article

Products

AppX1 shared article Microsoft Entra ID1 shared article Windows1 shared article

IOC

Type	Indicator	Articles
DOMAIN	`login.microsoftonline.com`	1

Note: Related entities are extracted from article content and do not necessarily indicate impact, targeting, vulnerability, or involvement.

Threat Research · huntress.com

Sideloaded AppX Package Can Steal Microsoft OAuth Tokens Through WWAHost.exe

The article demonstrates how a sideloaded AppX package with WindowsRuntimeAccess="all" can use WWAHost.exe and WebAuthenticationBroker to display Microsoft’s legitimate sign-in fl…

Sep 23, 2026

MITRE ATT&CK

Vendors

Products

IOC

Related Articles

Sideloaded AppX Package Can Steal Microsoft OAuth Tokens Through WWAHost.exe