Sideloaded AppX packages can abuse WWAHost.exe and WindowsRuntimeAccess=all to launch a real Microsoft login flow, capture OAuth codes, and steal tokens even after MFA. Detect via MSAppHost/3.0 traffic. #WWAHost #EntraID #DeveloperMode