What is token theft?

Token theft is a cyberattack technique in which an adversary steals a valid authentication token and uses it to gain unauthorized access to systems, applications, or data. They can do this without ever obtaining the user's password. Because the stolen token represents proof of an already-completed authentication event, the attacker can bypass standard login controls, including multifactor authentication (MFA).

As organizations have expanded their use of cloud services, SaaS applications, and federated identity systems, authentication tokens have become one of the most targeted assets in an adversary's playbook. The CrowdStrike 2026 Global Threat Report found that valid account abuse accounted for 35% of cloud incidents in 2025. Token theft is a central technique enabling that trend.

How Authentication Tokens Work

Modern applications rely on token-based authentication to manage user sessions without requiring repeated credential validation. When a user successfully authenticates by entering a password and completing an MFA challenge, the identity provider issues a token that serves as proof of that authentication. The application then accepts the token on subsequent requests, allowing the user to operate without logging in again.

These tokens contain encoded claims, including the user's identity, assigned permissions, the issuing authority, and expiration time. Tokens are typically stored in browser cookies, local storage, or session memory, and are presented automatically with each request.

Several token types appear regularly in enterprise environments:

• Session cookies maintain authenticated web sessions.
• OAuth tokens authorize third-party applications to interact with resources on a user's behalf.
• JSON Web Tokens (JWTs) carry identity and permission claims in a compact, cryptographically signed format.
• Refresh tokens are used to generate new access tokens without requiring the user to re-authenticate. They can remain valid for days or weeks.

The security implication is direct. A stolen access token may give an attacker a limited window (typically an hour or less) before expiration. However, a stolen refresh token can sustain unauthorized access far longer, producing a continuous stream of valid access tokens until the compromise is detected and the token is revoked.

How Token Theft Occurs

Adversaries use several distinct techniques to obtain valid tokens, depending on their position and objectives.

Adversary-in-the-Middle (AiTM) phishing

AiTM phishing has emerged as one of the most effective methods for achieving token theft, specifically because it circumvents MFA. Rather than simply harvesting credentials from a fake login page, an AiTM attack proxies the victim's actual authentication session through attacker-controlled infrastructure. The user completes a legitimate authentication flow, including any MFA challenge, while the adversary intercepts the resulting session token in real time. From the target system's perspective, the session that follows is indistinguishable from the user's own.

Infostealing

Infostealers target tokens already resident on compromised devices. These malware families are designed to extract authentication tokens, session cookies, and saved credentials from browser storage, then transmit them to attacker-controlled infrastructure. The CrowdStrike 2025 Global Threat Report noted that threat actors updated Stealc and Vidar in 2024 to specifically target cloud accounts and credentials, an early signal of how deliberately this class of malware was being retooled for cloud environments.

That trajectory continued into 2025. The CrowdStrike 2026 Global Threat Report identified ShaiHulud, a self-propagating information stealer that spread via a supply-chain attack targeting the npm ecosystem. Beyond collecting multiple credential types from infected machines, ShaiHulud was specifically designed to search the host for authentication tokens and use them to self-propagate by infecting additional npm packages, turning stolen tokens into an infection mechanism rather than just a credential harvest. The initially affected package was downloaded more than 2 million times within weeks of the campaign's discovery.

Pass-the-cookie and pass-the-token attacks

These attacks replay the use of a stolen token from a different device or network context. Once stolen, a token can be injected into an attacker's own browser session or API tooling. The receiving service validates the token and grants access, having no mechanism to determine that the presenting device is not the one that was originally authenticated.

Cross-site scripting (XSS)

A cross-site scripting attack is an additional attack vector found in web application environments. Malicious JavaScript injected into a vulnerable application can read tokens from browser storage and exfiltrate them without any direct interaction from the targeted user.

Primary Refresh Tokens (PRTs)

PRTs are used in Microsoft Entra ID and comparable SSO implementations. A PRT grants seamless access across all applications connected to the SSO environment without requiring repeated authentication. In impact and persistence, a compromised PRT is comparable to a Golden Ticket attack in on-premises Active Directory. It can result in broad, sustained, and difficult-to-detect access across an organization's identity ecosystem.

Why Token Theft Presents Significant Risk

The primary risk of token theft is the circumvention of authentication controls that organizations rely on as a core security measure. Because tokens are issued only after a successful authentication event, their theft effectively negates the protections MFA was designed to provide. An adversary presenting a stolen token never triggers a login prompt; they operate within a session that the identity provider already considers legitimate.

Detection is a compounding challenge. Malicious activity conducted through a stolen session can closely mirror normal user behavior. The token is valid, and the access patterns may be familiar. The activity may generate no alerts in systems that evaluate authentication events in isolation.

Identifying token theft requires behavioral analysis capable of detecting subtle anomalies, such as:

• A session appearing from an atypical geographic location
• An IP address that is inconsistent with the user's history
• Access patterns that deviate from established baselines.

The lateral movement potential is also considerable. A valid SSO or OAuth token can provide entry across multiple connected applications simultaneously. Token-based entry removes several friction points that would otherwise slow an attacker's progression through an environment.

Defending Against Token Theft

Effective defense against token theft requires addressing the attack surface at multiple layers.

Phishing-resistant MFA

Phishing-resistant MFA is the most direct control against AiTM-based token theft. FIDO2-based authentication cannot be proxied. The authentication proof is cryptographically tied to the originating device, so intercepting the session in transit yields nothing that can be replayed. Authentication methods that rely on SMS or push notifications do not offer this property and remain vulnerable to AiTM interception.

Short token lifetimes and rotation policies

Organizations should reduce the window of utility for any stolen token. Access tokens with brief expiration intervals (typically 15 minutes to 1 hour) limit how long an adversary can operate before the credential becomes invalid. Refresh tokens should be bound to strict re-authentication requirements, particularly when used to access sensitive resources or elevated privileges.

Conditional access policies

Implement policies that extend the security evaluation beyond token validity to include contextual signals. Unusual authentication geography, anomalous IP addresses, unrecognized device fingerprints, and off-hours access patterns can all serve as indicators that a valid token may be in use by an unauthorized party.

Configuring policies to trigger additional verification — or to block access outright — under these conditions provides an effective layer of defense.

Behavioral monitoring

Behavioral monitoring across identity data sources addresses the visibility gap exploited by token theft. An endpoint may show nothing unusual, as the malicious session exists entirely within cloud and SaaS authentication logs. However, correlating identity events across those sources, rather than evaluating them in isolation, can surface the anomalies indicative of a compromised session.

Proper token scoping

Least-privilege token scoping limits the blast radius in the event of theft. OAuth grants and API tokens should be provisioned with the minimum permissions required for their intended function. A token scoped with read access for a single application is significantly less damaging if stolen than one carrying broad write permissions across multiple services.

Protect Your Organization from Token Theft with CrowdStrike

CrowdStrike Falcon® Next-Gen Identity Security is designed to detect and respond to token-based attacks across hybrid identity environments. By correlating context from authentication events — including login location, device signals, access patterns, and risk level — the platform can identify sessions that appear to be hijacked. Compromise detection triggers real-time response actions, such as revoking the session, refreshing tokens, disabling the account, or updating access policies within the identity provider, such as Entra ID.

Because the platform operates across multiple cloud identity providers rather than a single vendor's ecosystem, it addresses the reality that adversaries rarely confine their activity to one environment.

CrowdStrike Falcon® Next-Gen SIEM provides cross-domain telemetry correlation, making token theft visible at scale. By unifying endpoint, identity, and cloud data in a single view, it enables security teams to connect signals that may appear unremarkable in isolation (a valid session, a routine access event, an expected API call) and identify the pattern that indicates a compromised credential.

Token theft has become a fixture of the modern identity threat landscape precisely because it is effective and difficult to detect with conventional controls. Authentication tokens are the mechanism by which organizations enable seamless, scalable user access. Protecting them requires the same rigor that security teams apply to credentials themselves.

To learn more about how the CrowdStrike Falcon® platform can protect your organization from token theft, schedule a free identity security risk review or sign up for a free trial today.