OAuth Token Theft via Sideloaded AppX Packages Abusing Microsoft-Signed Web Hosts (WWAHost.exe)
OAuth Token Theft via Sideloaded AppX Packages Abusing (TL-2026-2628) is a high-severity software vulnerability, first published 2026-09-23. It has no confirmed attribution, affects Microsoft Windows AppX Web Host (WWAHost.exe) /, maps to 11 MITRE ATT&CK techniques (T1071.001, T1078.004, T1087.004), and is covered by 9 detection rules and 7 indicators of compromise.
Key facts for TL-2026-2628
- Threat ID
- TL-2026-2628
- Severity
- HIGH
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-09-23
- Last reviewed
- 2026-09-23
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 7
Malware and tooling in OAuth Token Theft via Sideloaded AppX Packages Abusing
Malware and tooling: askWAM
Huntress researcher Andrew Schwartz demonstrates a post-compromise technique that sideloads a malicious AppX package declaring WindowsRuntimeAccess="all" to abuse the Microsoft-signed AppX web host WWAHost.exe and the legacy WebAuthenticationBroker WinRT API. The attacker's JavaScript invokes WebAuthenticationBroker.authenticateAsync() using Microsoft Office's first-party Entra ID client ID, presenting the real login.microsoftonline.com sign-in UI inside a chromeless native host and capturing the resulting OAuth authorization code via an out-of-band (oob) redirect URI, yielding persistent, MFA-surviving Microsoft 365/Entra ID access.
How OAuth Token Theft via Sideloaded AppX Packages Abusing works
This technique targets Windows endpoints where Developer Mode or the enterprise 'Allow all trusted apps to install' (AllowAllTrustedApps) sideloading policy is enabled. An attacker with existing code execution registers a minimal, self-signed AppX package as a standard user via `Add-AppxPackage -Register`. The package's AppxManifest.xml declares `WindowsRuntimeAccess="all"` on its ContentUriRules, pointing the web content URI at attacker-controlled infrastructure. When activated, the package is rendered by WWAHost.exe (Windows Web App Host) — a Microsoft-signed binary — which grants the attacker's hosted JavaScript full Windows Runtime API access rather than the sandboxed access a normal browser tab would receive.
From inside this trusted host, the JavaScript calls the legacy `WebAuthenticationBroker.authenticateAsync()` API, supplying Microsoft Office's real first-party Entra ID application (client) ID (`d590ed36-52b3-4102-aeff-aad2292ab01c`) and the `urn:ietf:wg:oauth:2.0:oob` out-of-band redirect URI. Because WebAuthenticationBroker is a legacy WinRT API inherited by any AppX host through the shared Windows Runtime activation layer (not gated to individual host binaries), the broker opens a genuine, unmodified `login.microsoftonline.com` sign-in dialog with no browser chrome or address bar. The victim authenticates normally, including completing MFA — nothing is spoofed or intercepted at the credential layer, so MFA is not bypassed technically, it is simply irrelevant: the user is a legitimate, willing participant in a real Microsoft authentication ceremony staged inside a trusted-looking native surface.
The resulting OAuth authorization code is returned to the attacker's JavaScript through the oob callback rather than a browser redirect, and is exchanged offline for access and refresh tokens scoped to whatever delegated permissions the Office client ID carries — observed scopes include Mail.ReadWrite, Mail.Send, Files.Read, Files.ReadWrite.All, FileStorageContainer.Selected, Channel.Create, ChannelMessage.Send, Chat.ReadWrite, TeamMember.ReadWrite.All, Calendar.ReadWrite, Contacts.ReadWrite, Directory.Read.All, Directory.AccessAsUser.All, and notably AuditLog.Create, which the researcher flags as enabling investigation evasion. The refresh token then permits silent, indefinite token regeneration from any machine until an administrator revokes it or a Continuous Access Evaluation (CAE) event fires — giving the attacker durable, cross-device access to the victim's full Microsoft 365 and Entra ID footprint without ever touching the victim's password or MFA factor again.
Huntress ties the technique to a broader body of AppX/MSIX packaging-abuse research, including Nick Powers' DEF CON 34 talk 'MSIX'd Up: Weaponizing the Modern Windows App Packaging Ecosystem' and Dirk-jan Mollema's askWAM tool, which requests Entra ID tokens directly from the Windows Web Account Manager (WAM) broker. The published defense is a single invariant network signature: any HTTP(S) request bearing the `MSAppHost/3.0` User-Agent — the fixed identifier for AppX web hosts — to a destination outside Microsoft's own domains is anomalous, regardless of which specific WinRT API a given AppX host abuses.
MITRE ATT&CK techniques used in TL-2026-2628
Command and Control
Persistence
Discovery
defense-impairment
Collection
T1114.002 Remote Email Collection; T1530 Data from Cloud Storage
Stealth
T1218 System Binary Proxy Execution
Credential Access
T1528 Steal Application Access Token
Lateral Movement
lateral-movement
T1550.001 Application Access Token
Exfiltration
Affected products and versions in OAuth Token Theft via Sideloaded AppX Packages Abusing
- Microsoft — Windows AppX Web Host (WWAHost.exe) / WebAuthenticationBroker WinRT API
Vulnerable versions: Windows 10; Windows 11 (any build shipping WWAHost.exe with Developer Mode or AllowAllTrustedApps sideloading enabled) - Microsoft — Microsoft 365 / Entra ID (Office first-party OAuth client)
Vulnerable versions: Entra ID tenants permitting the Office first-party client ID (d590ed36-52b3-4102-aeff-aad2292ab01c) to complete OAuth authorization-code flows without device/token-binding controls
Remediation for OAuth Token Theft via Sideloaded AppX Packages Abusing
Patches
- No vendor patch has been published and no CVE has been assigned; this abuses legitimate AppX/WebAuthenticationBroker design behavior rather than a coding flaw, so remediation is policy-based, not a code fix
Immediate actions
- Disable Developer Mode fleet-wide via GPO: Computer Configuration > Administrative Templates > Windows Components > App Package Deployment > Allow all trusted apps to install > Disabled
- Audit HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock\AllowDevelopmentWithoutDevLicense across the fleet and remediate any host where it is set to 1
- Deploy the published Sigma rule detecting MSAppHost/3.0 User-Agent traffic to non-Microsoft destinations at the web proxy
Workarounds
- Set the enterprise sideloading policy ('Allow all trusted apps to install') to Disabled unless compensated by Windows Defender Application Control (WDAC)
- Alert on `Add-AppxPackage -Register` executed from paths outside `WindowsApps` via PowerShell Script Block Logging (Event ID 4104)
Longer-term hardening
- Require compliant/managed devices for Microsoft 365/Entra ID token issuance via Conditional Access
- Enable Continuous Access Evaluation (CAE) to shrink the usable window of a stolen token
- Implement Token Protection for supported Microsoft 365 workloads to bind tokens to the issuing device
- Shorten refresh-token lifetimes, especially for privileged or high-risk accounts
Timeline of OAuth Token Theft via Sideloaded AppX Packages Abusing
- Nick Powers presents 'MSIX'd Up: Weaponizing the Modern Windows App Packaging Ecosystem' at DEF CON 34, documenting broader AppX/MSIX packaging-abuse techniques that underpin the sideloading vector later used in this OAuth-theft technique.
- Threadlinqs threat-intelligence pipeline ingests the Huntress publication via RSS hunt feed for correlation and detection engineering.
- Huntress publishes mitigation guidance: disable Developer Mode via GPO, shorten refresh-token lifetimes, enable Continuous Access Evaluation, and require compliant devices via Conditional Access.
- Huntress publishes a Sigma detection rule flagging MSAppHost/3.0 User-Agent traffic to non-Microsoft destinations as the invariant network signature for AppX web-host abuse.
- Full kill chain disclosed: malicious AppX sideloading via a WindowsRuntimeAccess="all" manifest abusing WWAHost.exe to invoke WebAuthenticationBroker.authenticateAsync() with Microsoft Office's first-party client ID and an oob redirect URI.
- Huntress researcher Andrew Schwartz publishes 'Stealing OAuth Tokens Through Microsoft's Front Door', disclosing the WWAHost.exe/WebAuthenticationBroker OAuth-theft technique.
Sources cited for OAuth Token Theft via Sideloaded AppX Packages Abusing
- Stealing OAuth Tokens Through Microsoft's Front Door
- DEF CON 34 - Nick Powers - MSIX'd Up: Weaponizing the Modern Windows App Packaging Ecosystem
- askWAM - Ask the Web Account Manager (WAM) for Entra ID tokens
- What is MSIX? (MSIX/AppX packaging overview)
- Traitorware: How Hackers Abuse Legitimate Apps to Hijack Microsoft 365
- 6 Months of Researching OAuth Application Attacks
More in vulnerability
- cPanel/WHM CalDAV/CardDAV and WP Toolkit Flaws Enable Cross-Account Access and Root Privilege Escalation (CVE-2026-68490, CVE-2026-87899, CVE-2026-87900)
- CVE-2026-94127: Critical F5 BIG-IP APM Zero-Day Heap Overflow in OAuth Authorization Server Exploited for Unauthenticated Remote Code Execution
- Eclypsium InfraTrust Report: Mass Active Exploitation of Network Management Systems (Cisco FMC/ISE CVE-2026-20079, CVE-2026-76460; SonicWall SMA 1000 CVE-2026-83548/83549; Linux Kernel CopyFail CVE-2026-31431)
- ConfigConfusion: Missing Authorization Check in GCP Config Connector Lets a Kubernetes Namespace User Seize Organization Owner
- CVE-2026-87902: Critical Unauthenticated Local File Inclusion in WordPress Core (Conditional RCE)
Detection coverage for TL-2026-2628
As of 2026-09-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2628 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.