Skip to content
Threat Feed
Subscribe

Product

Windows (11 24H2 and Later)

1 brief RSS
high advisory

OAuth Token Theft via Sideloaded AppX and WWAHost.exe

Attackers can abuse sideloaded AppX packages and the legitimate WWAHost.exe binary to trigger a genuine Microsoft OAuth login flow, capturing valid authentication tokens without traditional phishing indicators.

Windows oauth-theft living-off-the-land sideloading
1r 2t