Full Report
A sideloaded package turns a Microsoft-signed binary into an OAuth token theft tool. No phishing domain, no spoofed UI, no browser. Here's how to detect it.
Analysis Summary
# Tool/Technique: OAuth Token Theft via AppX Sideloading (WWAHost Abuse)
## Overview
This technique involves the abuse of the legitimate Microsoft-signed Windows Web App Host (`WWAHost.exe`) and the `WebAuthenticationBroker` API to steal OAuth tokens. By sideloading a malicious AppX package on a system where "Developer Mode" is enabled, an attacker can trigger a legitimate Microsoft sign-in prompt. Because the process is signed and the authentication occurs against official Microsoft endpoints, it bypasses traditional phishing protections, UI spoofing detection, and MFA (as the user completes a valid MFA challenge which the attacker then intercepts).
## Technical Details
- **Type:** Technique / Living-off-the-Land (LotL)
- **Platform:** Windows 10, Windows 11 (Tested on 24H2)
- **Capabilities:** OAuth token interception (Access and Refresh tokens), MFA bypass, execution of remote JavaScript with Windows Runtime (WinRT) privileges.
- **First Seen:** Reported September 23, 2024 (Article date cited as 2026, likely 2024 per current context).
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1133 - External Remote Services (via stolen tokens)
- **TA0003 - Persistence**
- T1137 - Office Application Startup
- **TA0005 - Defense Evasion**
- T1553.001 - Subvert Trust Controls: Gatekeeper Bypass
- T1218 - System Binary Proxy Execution
- **TA0006 - Credential Access**
- T1528 - Steal Application Access Token
- T1557 - Adversary-in-the-Middle
## Functionality
### Core Capabilities
- **Legitimate UI Rendering:** Uses `WWAHost.exe` to render a real `login.microsoftonline.com` dialog, making the attack indistinguishable from a legitimate login to the end user.
- **API Abuse:** Leverages `WindowsRuntimeAccess="all"` in the AppX manifest to allow remote-hosted JavaScript to call the `WebAuthenticationBroker`.
- **Token Theft:** Intercepts the OAuth response containing access and refresh tokens after the user successfully authenticates.
### Advanced Features
- **MFA Survival:** Because the user provides a legitimate MFA claim to Microsoft, the resulting token is fully authorized, allowing the attacker to bypass MFA requirements.
- **Signature Evasion:** The entire execution chain involves only signed Microsoft binaries, rendering signature-based antivirus/EDR ineffective.
## Indicators of Compromise
- **File Names:** `AppxManifest.xml` (within a suspicious sideloaded folder).
- **Registry Keys:**
- `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock\AllowDevelopmentWithoutDevLicense` (Set to `1`).
- **Network Indicators:**
- **User Agent:** `MSAppHost/3.0` (Highly specific to this execution environment).
- Outbound connections from `WWAHost.exe` to non-Microsoft/unauthorized external domains.
- **Behavioral Indicators:**
- Execution of PowerShell command: `Add-AppxPackage -Register [path]\AppxManifest.xml`.
- `WWAHost.exe` calling WinRT APIs to initiate `WebAuthenticationBroker` flows.
## Associated Threat Actors
- Currently documented as a proof-of-concept/discovery by Huntress researchers; however, the technique falls under **Living-off-Trusted-Sites (LotTS)** strategies used by sophisticated Phishing and BEC (Business Email Compromise) actors.
## Detection Methods
- **Behavioral Detection:** Monitor for the specific User Agent `MSAppHost/3.0` in web logs or EDR telemetry, especially when communicating with external or newly observed domains.
- **Process Monitoring:** Baseline `WWAHost.exe` activity. Alert on `WWAHost.exe` connecting to the internet if no legitimate UWP/AppX web apps are expected to be running.
- **Registry Monitoring:** Monitor for changes to `AppModelUnlock` which enables Developer Mode, a prerequisite for the attack.
## Mitigation Strategies
- **Disable Developer Mode:** Ensure "Developer Mode" is disabled via Group Policy or MDM across the enterprise.
- **Restrict AppX Sideloading:** Use policies to prevent users from registering AppX packages from outside the Microsoft Store.
- **Conditional Access:** Implement strict Conditional Access policies that require compliant, managed devices, which can mitigate the impact of stolen tokens used from unmanaged attacker machines.
- **Audit Administrative Rights:** Since enabling Developer Mode requires local admin, reducing the number of local admins limits the attack surface.
## Related Tools/Techniques
- **Living-off-the-Land Binaries (LOLBAS):** Similar to `regsvr32` or `mshta` abuse.
- **EvilProxy / Modlishka:** While those use reverse proxies, this technique achieves similar results via local binary proxying.
- **Device Code Phishing:** Similar outcome (token theft) but uses a different protocol flow.