A sideloaded AppX package can abuse WWAHost.exe and WindowsRuntimeAccess="all" to open a real Microsoft login flow, capture OAuth authorization codes, and steal access plus refresh tokens even when MFA is completed. The article also shows that the abuse is detectable with a proxy rule for MSAppHost/3.0 traffic to non-Microsoft destinations and highlights Developer Mode as the key prerequisite. #WWAHost #WebAuthenticationBroker #MSAppHost #DeveloperMode #EntraID #MicrosoftOffice