Microsoft 365 Access Tokens

The threat actor ToddyCat is using new hacking tools to steal corporate email data, including a custom tool called TCSectorCopy. They aim to obtain OAuth 2.0 authorization tokens from user browsers for accessing corporate mail. According to Kaspersky, this allows them to access emails outside the compromised infrastructure. ToddyCat has been active since 2020, targeting…