NPD4n6: Nicks DFIR blog

Great post by Dirk-jan Mollema on token collection via phishing by an adversary

https://dirkjanm.io/phishing-for-microsoft-entra-primary-refresh-tokens/