OAuth Token Theft Through Microsoft's Front Door | Huntress

A sideloaded package turns a Microsoft-signed binary into an OAuth token theft tool. No phishing domain, no spoofed UI, no browser. Here's how to detect it.