Cached Token Theft: Extracting Azure and Microsoft Graph Refresh Tokens from the macOS Keychain via PowerShell
PowerShell command-line tools on macOS fall back to standard Authorization Code flow, caching refresh and access tokens in the Keychain. This post explores how any script executed by the user can s...