Token Theft
Stealing access or refresh tokens, increasingly via infostealer malware, to access resources without credentials. Sender-constrained tokens and short lifetimes reduce the impact.
Token theft is the reason "we have MFA" is no longer a sufficient answer. Infostealers lift tokens and cookies from the endpoint, phishing kits capture them in real time, and both leave the attacker with a credential that already satisfied every policy at issuance. Short lifetimes reduce the window, sender-constraining removes the replay, and revocation has to cover refresh tokens rather than just passwords.
See also: session hijacking, infostealer, DPoP, refresh token
Related on Start with Identity
- GlossaryDevice Bound Session Credentials (DBSC)
Device Bound Session Credentials (DBSC) is a web standard that binds a browser session to a private key held in the device's hardware, so a session cookie stole
- GlossaryAccount Takeover (ATO)
When an attacker gains control of a legitimate account, often via stolen credentials, phishing, or session theft. A leading cause of breaches and fraud. The dis
- GlossaryAdversary-in-the-Middle (AitM)
Adversary-in-the-middle (AitM, written AiTM by MITRE) is an attack in which the attacker positions itself between two parties, such as a user and a sign-in serv
- TechniquePrimary Refresh Token theft
Code already running in a signed-in Windows session can drive the device's own Windows Hello key to obtain a Primary Refresh Token, no PIN prompt, no admin righ
- BlogThree Russian clusters move from password phishing to OAuth token theft
Google Threat Intelligence Group tracked UNC6293, UNC7005, and UNC5976 abusing device-code flow, verification-code relay, and fake Continue with Google pages to
- BlogA CVSS 10.0 bug let one user's Terraform token serve another user's request
HashiCorp's Terraform MCP Server failed to assign unique session identifiers in stateless HTTP mode, so a token supplied by one user could be reused for later r