# token-theft

Source: https://startwithidentity.com/glossary/token-theft/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

Stealing access or refresh tokens, increasingly via infostealer malware, to access resources without credentials. Sender-constrained tokens and short lifetimes reduce the impact.

Token theft is the reason "we have MFA" is no longer a sufficient answer. Infostealers lift tokens and cookies from the endpoint, phishing kits capture them in real time, and both leave the attacker with a credential that already satisfied every policy at issuance. Short lifetimes reduce the window, sender-constraining removes the replay, and revocation has to cover refresh tokens rather than just passwords.

See also: [session hijacking](https://startwithidentity.com/glossary/session-hijacking/), [infostealer](https://startwithidentity.com/glossary/infostealer/), [DPoP](https://startwithidentity.com/glossary/dpop/), [refresh token](https://startwithidentity.com/glossary/refresh-token/)