Microsoft Authenticator

NovaCookies turns an MFA approval into a live Microsoft 365 session for $320

Island's write-up describes an adversary-in-the-middle proxy that hands passwords, push approvals and SMS codes to real Microsoft servers, then keeps the cookie Microsoft issues. Origin binding is the only listed control that breaks it.