Token Theft
Stealing access or refresh tokens, increasingly via infostealer malware, to access resources without credentials. Sender-constrained tokens and short lifetimes reduce the impact.
Token theft is the reason "we have MFA" is no longer a sufficient answer. Infostealers lift tokens and cookies from the endpoint, phishing kits capture them in real time, and both leave the attacker with a credential that already satisfied every policy at issuance. Short lifetimes reduce the window, sender-constraining removes the replay, and revocation has to cover refresh tokens rather than just passwords.
See also: session hijacking, infostealer, DPoP, refresh token
Related on Start with Identity
- GlossaryAccount Takeover (ATO)
When an attacker gains control of a legitimate account, often via stolen credentials, phishing, or session theft. A leading cause of breaches and fraud. The dis
- TechniquePrimary Refresh Token theft
Code already running in a signed-in Windows session can drive the device's own Windows Hello key to obtain a Primary Refresh Token, no PIN prompt, no admin righ
- BlogThree Russian clusters move from password phishing to OAuth token theft
Google Threat Intelligence Group tracked UNC6293, UNC7005, and UNC5976 abusing device-code flow, verification-code relay, and fake Continue with Google pages to
- GlossaryCredential Stuffing
An attack that replays username and password pairs leaked from other breaches against a target, exploiting password reuse. Defended with MFA, passkeys, and bot
- GlossaryLateral Movement
How an attacker moves from an initial foothold to other systems and accounts, often abusing identity and trust relationships. A primary target of identity threa
- BlogA CVSS 10.0 bug let one user's Terraform token serve another user's request
HashiCorp's Terraform MCP Server failed to assign unique session identifiers in stateless HTTP mode, so a token supplied by one user could be reused for later r