Cached Token Theft: Extracting Azure and Microsoft Graph Refresh Tokens from the macOS Keychain via PowerShell

TL;DR: While native macOS apps like Teams and Outlook benefit from Platform SSO and hardware-bound tokens, PowerShell modules like Azure PowerShell and Microsoft Graph PowerShell still fall back to standard Authorization Code flow. This leaves token artifacts with sensitive privileges cached in your Keychain. Since the PowerShell Core process (pwsh) attempts by default to use the refresh token to