I think the ngrok tunnel server they setup to exfiltrate data actually sent the GDID to the ngrok servers. This GDID was then linked to non-VPN IP logs by Microsoft.
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments