you are viewing a single comment's thread
view the rest of the comments
[–] 3 points 3 months ago

I think the ngrok tunnel server they setup to exfiltrate data actually sent the GDID to the ngrok servers. This GDID was then linked to non-VPN IP logs by Microsoft.

  • source
  • parent