Adobe Sign

N0va captures refresh tokens from sign-ins the identity provider itself approved

ANY.RUN says the kit lures staff with Teams, DocuSign and Dropbox pages, walks them through a genuine device code sign-in, and then takes the access and refresh tokens to register a device of its own.