Repository navigation
Conversation
Liran017
marked this pull request as ready for review
October 1, 2026 12:13
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR adds WWAHost.exe, the Microsoft-signed Windows Web App Host, based on Huntress research published September 29, 2026.
The documented technique registers an AppX package whose
ContentUriRulesgrantsWindowsRuntimeAccess="all"to an attacker-controlled origin. The package then loads attacker-hosted JavaScript inside WWAHost.exe with Windows Runtime access. Huntress reports no UAC prompt, SmartScreen prompt, or signature check during the demonstrated flow.The published proof of concept demonstrated OAuth refresh-token theft through Microsoft’s legitimate login flow, with the stolen tokens surviving MFA. The entry carries two command items for the same registration step: the execution behaviour as
Category: Execute/ T1218 (System Binary Proxy Execution), and the demonstrated outcome asCategory: Credentials/ T1528 (Steal Application Access Token).Registration runs as a standard user, but Developer Mode must already be enabled or an enterprise sideloading policy must permit registration. Without that prerequisite,
Add-AppxPackage -Registerfails with0x80073CFF. Huntress tested the technique on Windows 11 24H2, build 26100.Huntress also provides a Sigma rule detecting the
MSAppHost/3.0user agent communicating with non-Microsoft hosts.