What is token theft?

How do attackers steal tokens?

Every authenticated session produces artifacts: a session cookie in the browser, an access token held by an app, a refresh token that quietly renews both. Attackers have industrialized three main ways of taking them. Adversary-in-the-middle (AiTM) phishing puts a reverse proxy between the victim and the real login page, so the user completes a genuine sign-in, including the MFA prompt, while the proxy captures the resulting session cookie. It is the modern engine behind most session hijacking.

Infostealer malware takes a different path: it lands on the endpoint and harvests cookies, saved passwords, and tokens directly from browser storage and application caches, which is one reason enterprise browser security has become an identity problem rather than just an endpoint problem. The third path skips the user entirely. Attackers steal OAuth and API tokens from the systems that hold them: source code, CI logs, misconfigured storage, or a compromised SaaS vendor whose integration tokens fan out into customer tenants, a blast radius pattern closely related to OAuth app risk.

• AiTM phishing proxies: capture session cookies during a real, MFA-completed login
• Infostealer malware: exfiltrates cookies and tokens from browsers and app caches on the device
• Supply-chain and infrastructure theft: OAuth grants, refresh tokens, and API keys lifted from vendors, repos, logs, and pipelines
• Pass-the-cookie replay: the stolen artifact is imported into the attacker's browser and simply reused

Why does token theft bypass MFA?

MFA protects the moment of authentication. A token is what you get after that moment succeeds. When an attacker replays a stolen session cookie or refresh token, the identity provider sees a bearer of valid proof, not a new login, so there is no password prompt and no MFA challenge to fail. Conditional access checks that were satisfied at issuance, device compliance, location, MFA strength, travel with the token unless the provider re-evaluates them continuously.

This is why token theft grew as MFA adoption grew. Organizations that rolled out one-time codes and push notifications forced attackers up the stack: instead of stealing the password before MFA, they steal the session after it. Even phishing-resistant MFA such as FIDO2 passkeys, which defeats AiTM capture of the login itself, does not help if malware lifts the cookie from the browser afterward. The result on the human side is an account takeover that never tripped a single authentication control.

What does token theft look like for non-human and AI identities?

Most token theft coverage focuses on employee sessions, but the larger and less defended surface is non-human identity. Service accounts, workloads, and integrations authenticate almost exclusively with long-lived bearer artifacts: API keys, OAuth refresh tokens, signing secrets, personal access tokens. These rarely have MFA to bypass in the first place, are seldom rotated, and often sit in places attackers already search, which is the core failure mode behind secret sprawl. The 2025 Salesloft Drift incident showed the scale: OAuth tokens stolen from one vendor's integration extended attacker access into hundreds of downstream customer environments.

AI agents raise the stakes again. An AI agent typically holds delegated tokens for email, calendars, code repositories, and internal tools, sometimes many at once, and stores them wherever its runtime keeps state. Stealing an agent's token can be worth more than stealing a user's session, because the agent's credential is broad, long-lived, and exercised by software that no one is watching. Sound API key security and vaulting reduce exposure, but the theft problem follows the token wherever it travels at runtime.

How do you detect token theft?

A stolen token is used from somewhere new, and that is the detection seam. The strongest signals are anomalies in how a previously issued token is exercised: a session cookie replayed from a different IP range, autonomous system, or device fingerprint than the one it was issued to; a refresh token redeemed from infrastructure the tenant has never seen; impossible travel between the issuing sign-in and the token's next use.

Identity providers surface some of this natively, with detections for anomalous tokens, attacker-in-the-middle patterns, and unfamiliar sign-in properties. Mature programs fold those signals into a broader identity threat detection and response practice: correlating token anomalies with endpoint infostealer alerts, watching for OAuth grants that suddenly pull data at machine speed, and treating a burst of activity from a normally quiet service account token as an incident, not a curiosity. For non-human tokens, detection depends on knowing baseline usage per credential, which requires an inventory of which tokens exist and who legitimately uses them from where.

How do you prevent token theft and replay?

Prevention works at three layers: make theft harder, make stolen tokens useless, and shrink what any single token can do. Making theft harder means phishing-resistant authentication to defeat AiTM capture, hardened and monitored endpoints to counter infostealers, and disciplined secrets management so machine tokens are vaulted rather than scattered through code and config.

Making stolen tokens useless is the more durable win. Token binding cryptographically ties a token to the device it was issued to, so a replayed copy fails. Continuous access evaluation revokes sessions in near real time when risk changes, instead of trusting a check performed at issuance. Short token lifetimes and aggressive refresh rotation narrow the replay window. For non-human identities, the equivalent is replacing static long-lived keys with short-lived, workload-attested credentials and zero standing privileges, so there is less durable material to steal. Finally, scope reduction through least privilege means that when a token is stolen anyway, it opens one door, not the estate.

• Deploy phishing-resistant MFA to cut off AiTM capture of human sessions
• Bind tokens to devices and enforce continuous access evaluation so replay fails
• Shorten token lifetimes and rotate refresh tokens on every use
• Vault machine credentials and prefer short-lived, attested tokens over static API keys
• Scope every token to least privilege so theft yields minimal reach

Frequently asked questions

Related terms