OAuth Token Theft via Sideloaded AppX Packages Abusing Microsoft-Signed Web Hosts (WWAHost.exe)

Key facts

Detection coverage

As of 2026-09-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2628 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: MSAppHost/3.0 User-Agent Egress to Non-Microsoft Destination With High-Risk Graph Scope Use

Detects the fixed MSAppHost/3.0 User-Agent (used by all AppX web hosts, including WWAHost.exe) reaching a destination outside Microsoft-owned domains — the Huntress-published invariant network signature for AppX web-host abuse — and/or Microsoft Office's first-party client ID (d590ed36-52b3-4102-aeff-aad2292ab01c) being used with high-risk delegated Graph scopes (AuditLog.Create, Directory.AccessAsUser.All, Files.ReadWrite.All) consistent with post-theft token abuse, internal spearphishing, and Graph-based collection/exfiltration.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1071.001, T1567, T1530, T1114.002, T1534
• Data sources: proxy_logs, windows_filtering_platform, microsoft_365_unified_audit_log, entra_id_sign_in_logs
• Severity: critical
• Confidence: high

Splunk SPL

index=proxy OR index=firewall sourcetype IN ("*proxy*","*squid*","*bluecoat*","*zscaler*") http_user_agent="MSAppHost/3.0"
| eval is_microsoft_dest=if(match(dest_host, "(?i)(\.microsoft\.com$|\.microsoftonline\.com$|\.live\.com$|\.office\.com$|\.windows\.net$)"), 1, 0)
| where is_microsoft_dest=0
| eval risk_reason="MSAppHost/3.0 (AppX web host User-Agent) egress to a non-Microsoft destination — invariant signature for WWAHost.exe/OAuth token exfiltration"
| table _time, src_ip, user, dest_host, dest_ip, http_user_agent, uri_path, risk_reason
| append
    [ search index=o365 OR index=azuread sourcetype IN ("o365:management:activity","azure:aad:signin") AppId="d590ed36-52b3-4102-aeff-aad2292ab01c"
      (Scope="*AuditLog.Create*" OR Scope="*Directory.AccessAsUser.All*" OR Scope="*Files.ReadWrite.All*")
    | eval risk_reason="Office first-party client ID token used with high-risk delegated Graph scopes (AuditLog.Create / Directory.AccessAsUser.All / Files.ReadWrite.All) consistent with WebAuthenticationBroker OAuth token theft"
    | table _time, user, ClientIP, AppId, Scope, risk_reason ]
| sort -_time

Microsoft KQL

let ProxyMSAppHost = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "WWAHost.exe"
| where RemoteUrl !endswith ".microsoft.com" and RemoteUrl !endswith ".microsoftonline.com" and RemoteUrl !endswith ".live.com" and RemoteUrl !endswith ".office.com"
| project Timestamp, DeviceName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName;
let RiskyGraphScopes = CloudAppEvents
| where Timestamp > ago(24h)
| where ApplicationId == "d590ed36-52b3-4102-aeff-aad2292ab01c"
| where RawEventData has_any ("AuditLog.Create", "Directory.AccessAsUser.All", "Files.ReadWrite.All")
| project Timestamp, AccountDisplayName, ApplicationId, RawEventData;
union ProxyMSAppHost, RiskyGraphScopes
| sort by Timestamp desc

Sigma

title: MSAppHost/3.0 User-Agent Egress to Non-Microsoft Destination
id: c9d3e7f1-4a6b-4c28-b1d5-8e2f9a0c5e03
status: experimental
description: Detects the fixed MSAppHost/3.0 User-Agent (used by all AppX web hosts, including WWAHost.exe) reaching a destination outside Microsoft-owned domains — the published invariant network signature for AppX web-host abuse used to exfiltrate stolen OAuth authorization codes/tokens.
references:
    - https://www.huntress.com/blog/stealing-oauth-tokens-through-microsofts-front-door
author: Threadlinqs Team
date: 2026/09/23
tags:
    - attack.command-and-control
    - attack.exfiltration
    - attack.t1071.001
    - attack.t1567
logsource:
    category: proxy
detection:
    selection:
        c-useragent|contains: 'MSAppHost/3.0'
    filter_microsoft:
        cs-host|endswith:
            - '.microsoft.com'
            - '.microsoftonline.com'
            - '.live.com'
            - '.office.com'
            - '.windows.net'
    condition: selection and not filter_microsoft
falsepositives:
    - Legitimate Microsoft Store / enterprise AppX applications reaching non-Microsoft first-party CDNs they legitimately depend on
level: critical

Known false positives:

• Legitimate Microsoft Store/enterprise AppX apps whose WWAHost.exe content reaches non-Microsoft first-party CDNs they legitimately depend on
• Office add-ins or approved compliance/automation tooling legitimately using AuditLog.Create/Directory.AccessAsUser.All scopes

Tuning notes: Maintain and regularly refresh the Microsoft-domain allowlist (microsoft.com, microsoftonline.com, live.com, office.com, windows.net, msftauth.net) to avoid false positives on legitimate first-party CDN egress. TL_OSINT_Scan corroboration for this threat shows 0 corroborated IOCs but flags a medium-confidence adjacent campaign, 'Microsoft phishing hosted on Backblaze B2 object storage' — both share an identity-phishing theme against Microsoft branding, so consider adding backblazeb2.com destinations to this rule's watchlist for infrastructure-overlap hunting even though it is not yet a confirmed shared indicator.

• 🔒 AppX Sideloading via Add-AppxPackage -Register Outside WindowsApps · unlock with TL Creds
• 🔒 WWAHost.exe Launched From Sideloaded AppX Package Path With Non-Microsoft Egress · unlock with TL Creds
• 🔒 [indicator] User-Agent Egress to Non-Microsoft Destination With High-Risk Graph Scope Use · unlock with TL Creds
• 🔒 AppX Sideloading via Add-AppxPackage -Register Outside WindowsApps · unlock with TL Creds
• 🔒 WWAHost.exe Launched From Sideloaded AppX Package Path With Non-Microsoft Egress · unlock with TL Creds
• 🔒 [indicator] User-Agent Egress to Non-Microsoft Destination With High-Risk Graph Scope Use · unlock with TL Creds
• 🔒 AppX Sideloading via Add-AppxPackage -Register Outside WindowsApps · unlock with TL Creds
• 🔒 WWAHost.exe Launched From Sideloaded AppX Package Path With Non-Microsoft Egress · unlock with TL Creds

Indicators of compromise

As of 2026-09-23, Threadlinqs Intelligence tracks 7 indicators of compromise for TL-2026-2628.

Technical analysis

This technique targets Windows endpoints where Developer Mode or the enterprise 'Allow all trusted apps to install' (AllowAllTrustedApps) sideloading policy is enabled. An attacker with existing code execution registers a minimal, self-signed AppX package as a standard user via `Add-AppxPackage -Register`. The package's AppxManifest.xml declares `WindowsRuntimeAccess="all"` on its ContentUriRules, pointing the web content URI at attacker-controlled infrastructure. When activated, the package is rendered by WWAHost.exe (Windows Web App Host) — a Microsoft-signed binary — which grants the attacker's hosted JavaScript full Windows Runtime API access rather than the sandboxed access a normal browser tab would receive.

From inside this trusted host, the JavaScript calls the legacy `WebAuthenticationBroker.authenticateAsync()` API, supplying Microsoft Office's real first-party Entra ID application (client) ID (`d590ed36-52b3-4102-aeff-aad2292ab01c`) and the `urn:ietf:wg:oauth:2.0:oob` out-of-band redirect URI. Because WebAuthenticationBroker is a legacy WinRT API inherited by any AppX host through the shared Windows Runtime activation layer (not gated to individual host binaries), the broker opens a genuine, unmodified `login.microsoftonline.com` sign-in dialog with no browser chrome or address bar. The victim authenticates normally, including completing MFA — nothing is spoofed or intercepted at the credential layer, so MFA is not bypassed technically, it is simply irrelevant: the user is a legitimate, willing participant in a real Microsoft authentication ceremony staged inside a trusted-looking native surface.

The resulting OAuth authorization code is returned to the attacker's JavaScript through the oob callback rather than a browser redirect, and is exchanged offline for access and refresh tokens scoped to whatever delegated permissions the Office client ID carries — observed scopes include Mail.ReadWrite, Mail.Send, Files.Read, Files.ReadWrite.All, FileStorageContainer.Selected, Channel.Create, ChannelMessage.Send, Chat.ReadWrite, TeamMember.ReadWrite.All, Calendar.ReadWrite, Contacts.ReadWrite, Directory.Read.All, Directory.AccessAsUser.All, and notably AuditLog.Create, which the researcher flags as enabling investigation evasion. The refresh token then permits silent, indefinite token regeneration from any machine until an administrator revokes it or a Continuous Access Evaluation (CAE) event fires — giving the attacker durable, cross-device access to the victim's full Microsoft 365 and Entra ID footprint without ever touching the victim's password or MFA factor again.

Huntress ties the technique to a broader body of AppX/MSIX packaging-abuse research, including Nick Powers' DEF CON 34 talk 'MSIX'd Up: Weaponizing the Modern Windows App Packaging Ecosystem' and Dirk-jan Mollema's askWAM tool, which requests Entra ID tokens directly from the Windows Web Account Manager (WAM) broker. The published defense is a single invariant network signature: any HTTP(S) request bearing the `MSAppHost/3.0` User-Agent — the fixed identifier for AppX web hosts — to a destination outside Microsoft's own domains is anomalous, regardless of which specific WinRT API a given AppX host abuses.

MITRE ATT&CK techniques by tactic:

Command and Control

T1071.001 Web Protocols

Persistence

T1078.004 Cloud Accounts

Discovery

T1087.004 Cloud Account

defense-impairment

T1112 Modify Registry

Collection

T1114.002 Remote Email Collection; T1530 Data from Cloud Storage

Stealth

T1218 System Binary Proxy Execution

Credential Access

T1528 Steal Application Access Token

Lateral Movement

T1534 Internal Spearphishing

lateral-movement

T1550.001 Application Access Token

Exfiltration

T1567 Exfiltration Over Web Service

Remediation

Patches

• No vendor patch has been published and no CVE has been assigned; this abuses legitimate AppX/WebAuthenticationBroker design behavior rather than a coding flaw, so remediation is policy-based, not a code fix

Immediate actions

• Disable Developer Mode fleet-wide via GPO: Computer Configuration > Administrative Templates > Windows Components > App Package Deployment > Allow all trusted apps to install > Disabled
• Audit HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock\AllowDevelopmentWithoutDevLicense across the fleet and remediate any host where it is set to 1
• Deploy the published Sigma rule detecting MSAppHost/3.0 User-Agent traffic to non-Microsoft destinations at the web proxy

Workarounds

• Set the enterprise sideloading policy ('Allow all trusted apps to install') to Disabled unless compensated by Windows Defender Application Control (WDAC)
• Alert on `Add-AppxPackage -Register` executed from paths outside `WindowsApps` via PowerShell Script Block Logging (Event ID 4104)

Longer-term hardening

• Require compliant/managed devices for Microsoft 365/Entra ID token issuance via Conditional Access
• Enable Continuous Access Evaluation (CAE) to shrink the usable window of a stolen token
• Implement Token Protection for supported Microsoft 365 workloads to bind tokens to the issuing device
• Shorten refresh-token lifetimes, especially for privileged or high-risk accounts

Affected and fixed versions

• Microsoft — Windows AppX Web Host (WWAHost.exe) / WebAuthenticationBroker WinRT API
  Vulnerable versions: Windows 10; Windows 11 (any build shipping WWAHost.exe with Developer Mode or AllowAllTrustedApps sideloading enabled)
• Microsoft — Microsoft 365 / Entra ID (Office first-party OAuth client)
  Vulnerable versions: Entra ID tenants permitting the Office first-party client ID (d590ed36-52b3-4102-aeff-aad2292ab01c) to complete OAuth authorization-code flows without device/token-binding controls

Timeline

• 2026-08-06 Nick Powers presents 'MSIX'd Up: Weaponizing the Modern Windows App Packaging Ecosystem' at DEF CON 34, documenting broader AppX/MSIX packaging-abuse techniques that underpin the sideloading vector later used in this OAuth-theft technique.
• 2026-09-23 Threadlinqs threat-intelligence pipeline ingests the Huntress publication via RSS hunt feed for correlation and detection engineering.
• 2026-09-23 Huntress publishes mitigation guidance: disable Developer Mode via GPO, shorten refresh-token lifetimes, enable Continuous Access Evaluation, and require compliant devices via Conditional Access.
• 2026-09-23 Huntress publishes a Sigma detection rule flagging MSAppHost/3.0 User-Agent traffic to non-Microsoft destinations as the invariant network signature for AppX web-host abuse.
• 2026-09-23 Full kill chain disclosed: malicious AppX sideloading via a WindowsRuntimeAccess="all" manifest abusing WWAHost.exe to invoke WebAuthenticationBroker.authenticateAsync() with Microsoft Office's first-party client ID and an oob redirect URI.
• 2026-09-23 Huntress researcher Andrew Schwartz publishes 'Stealing OAuth Tokens Through Microsoft's Front Door', disclosing the WWAHost.exe/WebAuthenticationBroker OAuth-theft technique.

Sources cited

• Stealing OAuth Tokens Through Microsoft's Front Door Huntress · Research · 2026-09-23
• DEF CON 34 - Nick Powers - MSIX'd Up: Weaponizing the Modern Windows App Packaging Ecosystem defcon.org · Research · 2026-08-06
• What is MSIX? (MSIX/AppX packaging overview) Microsoft · Vendor report · 2026-09-23
• askWAM - Ask the Web Account Manager (WAM) for Entra ID tokens GitHub · Code repository · 2026-09-23
• Traitorware: How Hackers Abuse Legitimate Apps to Hijack Microsoft 365 Huntress · Blog · 2026-09-23
• 6 Months of Researching OAuth Application Attacks Huntress · Blog · 2026-09-23

More in vulnerability

• CISA ICSA-26-307-01: Critical Authorization Bypass (CVE-2026-63017) and SQL Injection (CVE-2026-63774) in Subnet Solutions PowerSYSTEM Center
• LNbits Operators Urged to Shut Down Bitcoin Lightning Wallet Servers Amid Active Attacks via Extension Exploit
• CISA adds four KEVs: GPUStack CVE-2026-102895, SignalWire FreeSwitch CVE-2026-116779, OpenBSD OpenSSH CVE-2026-123158, IBM Aspera Faspex CVE-2026-123218
• Able2Shell: 33 N-able N-central Vulnerabilities Chained into RCE and Root Privilege Escalation; N-able Takes Hosted Cloud Offline
• Windows Dangling COM Object Registration Local Privilege Escalation (CVE-2026-66804, incomplete fix for CVE-2026-50343 'Dark Elevator')

Previous and next in vulnerability

• CVE-2026-87902: Critical Unauthenticated Local File Inclusion in WordPress Core (Conditional RCE) Previous report
• ConfigConfusion: Missing Authorization Check in GCP Config Connector Lets a Kubernetes Namespace User Seize Organization Owner Next report