Know
What is Session Token Theft?
Authentication tokens and session cookies allow applications to recognize a user after login. If an attacker steals a valid token, they may be able to impersonate the authenticated identity without knowing the password and, depending on the token and controls in place, without triggering a new MFA challenge.
Why it matters
Modern attackers increasingly target authenticated sessions because passwords are only one part of identity. Token theft is central to AiTM phishing, device-code abuse, infostealer operations, SaaS compromise, and cloud account takeover.
Evidence, not hype
Validated in the real world
Every record is labeled by evidence type and source strength so an incident, a standard, and emerging research are never presented as if they are the same thing.
Identity weaknesses played a material role in nearly 90% of Unit 42 investigations
Unit 42's 2026 Global Incident Response Report says identity was involved in nearly 90% of investigated incidents and that 65% of initial access was driven by identity-based techniques, including phishing, credential misuse, and permission abuse.
This frontline incident-response data validates identity as a primary modern attack surface rather than a supporting control category.
Microsoft documented an AI-enabled device-code phishing campaign operating at scale
Microsoft observed a widespread campaign abusing OAuth device-code authentication with automated infrastructure, dynamic code generation, AI-personalized lures, token acquisition, automated reconnaissance, and malicious inbox-rule persistence.
The campaign demonstrates that a victim can complete authentication on a legitimate Microsoft page and still authorize an attacker's session, making modern phishing a token and workflow problem rather than only a fake-password-page problem.
Large-scale AiTM phishing targeted more than 35,000 users across 13,000 organizations
Microsoft analyzed a multi-stage phishing campaign observed in April 2026 that targeted more than 35,000 users across more than 13,000 organizations and ultimately used adversary-in-the-middle infrastructure to capture authentication tokens.
This validates that session-token compromise and AiTM phishing are operating at enterprise scale and can bypass non-phishing-resistant MFA even when the user sees a legitimate authentication experience.
Understand the mechanics
How it works
- 1
A valid session or application token is created.
- 2
The attacker captures it through phishing, malware, browser theft, logs, exposed secrets, or OAuth abuse.
- 3
The token is replayed against the target service.
- 4
The service accepts the token as proof of prior authentication.
- 5
The attacker acts with the user or application’s permissions until the token expires or is revoked.
Practice
What to watch for
- Same session used from incompatible geographies or networks
- New user agent or device tied to an existing session
- Unexpected API activity
- Unusual token refresh patterns
- Sensitive actions without a corresponding interactive sign-in
Perform
What to do
- 1
Revoke active sessions and refresh tokens.
- 2
Identify how the token was acquired.
- 3
Remove malware or malicious browser extensions where relevant.
- 4
Review downstream actions and connected applications.
- 5
Rotate associated secrets and credentials if exposure extends beyond the session.
How to reduce the risk
- Phishing-resistant MFA
- Token protection and device binding where available
- Short-lived tokens
- Secure browser and endpoint posture
- Secrets management
- Continuous access evaluation
- Session anomaly detection
Business impact
- Silent account takeover
- Data exfiltration
- Privilege abuse
- BEC
- Cloud and SaaS compromise
What different roles should do
Security
- Investigate tokens and sessions as first-class security objects
Developer / Identity
- Use secure token storage, rotation, scoped permissions, and revocation mechanisms
Framework & standards context
- MITRE ATT&CK T1539 — Steal Web Session Cookie
- MITRE ATT&CK T1528 — Steal Application Access Token
Source transparency
Authoritative sources
- Microsoft: Understanding Tokens in Microsoft Entra ID ↗
- Microsoft Security: Breaking the code: AiTM token compromise ↗
Last reviewed: 2026-09-02