Token theft occurs when an attacker obtains a session cookie, access token, refresh token, API token, or similar credential and uses it to act as an already authenticated user or service. Because the original login may have completed MFA correctly, replaying the token can avoid another password or MFA prompt.
Where tokens come from
Applications issue tokens to avoid authenticating on every request. Tokens may represent a browser session, delegated OAuth permission, API access, workload identity, or the right to obtain new access tokens.
They can be stolen through information-stealing malware, malicious browser extensions, phishing proxies, cross-site scripting, exposed logs, public repositories, compromised developer machines, unsafe storage, or overly powerful SaaS integrations.
Why the blast radius varies
A short-lived token scoped to read one resource is different from a refresh token that can mint broad access for months. Important properties include audience, scope, lifetime, issuer, device binding, revocation support, and whether the token grants delegated or application-level privileges.
Defensive controls
- keep tokens short-lived and narrowly scoped;
- protect refresh tokens more strongly;
- use secure, HTTP-only cookie settings for browser sessions;
- avoid tokens in URLs, logs, source code, and chat;
- restrict OAuth applications and consent;
- monitor impossible travel, new devices, abnormal APIs, and unusual data access;
- reauthenticate for sensitive changes;
- support rapid session and token revocation;
- harden endpoints and browsers;
- bind tokens to clients or proof-of-possession mechanisms where supported.
Incident response
Resetting a password alone may leave valid tokens active. Revoke sessions, refresh tokens, application grants, app passwords, API keys, and newly enrolled authentication methods. Review mailbox rules, cloud audit logs, data access, and persistence. Identify the theft path before restoring access.
The bottom line
Modern attackers often steal proof that authentication already happened. Identity defense must protect the entire session lifecycle: issuance, storage, use, monitoring, expiration, and revocation—not merely the login screen.
