[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1528":3},{"item":4,"lessons":18,"controls":68,"related":99},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1528","T1528","Steal Application Access Token",32,"MITRE","**What attackers do.** Attackers steal application access tokens, such as OAuth tokens, to access cloud services and APIs as a user or application without needing a password. Malicious consent apps and token theft from endpoints are common routes. This serves the Credential Access tactic.\n\n**How to defend.** Restrict user consent to third-party applications and require admin review for high-privilege permissions. Shorten token lifetimes, use conditional access to bind tokens to compliant devices, and revoke tokens during incident response. Audit the applications and service principals that hold access to mail, files and directories.\n\n**Signs to look for.** Look for newly consented applications with broad permissions, token use from unfamiliar IP addresses, and API access patterns unlike the user's normal behaviour. A common gap is that password resets do not revoke existing tokens.","Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources.\n\nApplication access tokens are used to make authorized API requests on behalf of a user or service and are commonly used as a way to access resources in cloud and container-based applications and software-as-a-service (SaaS).  Adversaries who steal account API tokens in cloud and containerized environments may be able to access data and perform actions with the permissions of these accounts, which can lead to privilege escalation and further compromise of the environment.\n\nFor example, in Kubernetes environments, processes running inside a container may communicate with the Kubernetes API server using service account tokens. If a container is compromised, an adversary may be able to steal the container’s token and thereby gain access to Kubernetes API commands.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1528\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"legitimate-tools-weaponized-teams-phishing-npm-worms-and-device-code-abuse","Legitimate Tools Weaponized: Teams Phishing, npm Worms, and Device-Code Abuse","2026-10-13T16:20:16.436+00:00",{"slug":25,"title":26,"published_at":27},"wazza-phishing-kit-bypasses-detection-to-harvest-credentials-across-critical-sectors","Wazza Phishing Kit Bypasses Detection to Harvest Credentials Across Critical Sectors","2026-10-08T12:20:37.933+00:00",{"slug":29,"title":30,"published_at":31},"antino-backdoor-abuses-microsoft-365-for-stealthy-c2-in-asia-espionage-campaign","Antino Backdoor Abuses Microsoft 365 for Stealthy C2 in Asia Espionage Campaign","2026-10-02T18:20:59.758+00:00",{"slug":33,"title":34,"published_at":35},"eviltokens-phishing-as-a-service-exploits-device-code-authentication-flow","EvilTokens Phishing-as-a-Service Exploits Device Code Authentication Flow","2026-09-22T22:21:55.631+00:00",{"slug":37,"title":38,"published_at":39},"ai-powered-device-code-phishing-compromises-12000-inboxes","AI-Powered Device-Code Phishing Compromises 12,000 Inboxes","2026-09-22T18:21:01.457+00:00",{"slug":41,"title":42,"published_at":43},"eviltokens-phaas-bypasses-mfa-via-device-code-phishing-hits-12000-accounts","EvilTokens PhaaS Bypasses MFA via Device-Code Phishing, Hits 12,000 Accounts","2026-09-22T16:21:25.436+00:00",{"slug":45,"title":46,"published_at":47},"ai-powered-device-code-phishing-platform-compromises-12000-inboxes","AI-Powered Device Code Phishing Platform Compromises 12,000+ Inboxes","2026-09-22T16:20:43.148+00:00",{"slug":49,"title":50,"published_at":51},"n0va-phishkit-hijacks-legitimate-auth-flows-to-steal-sso-tokens","N0va Phishkit Hijacks Legitimate Auth Flows to Steal SSO Tokens","2026-09-16T14:21:53.687+00:00",{"slug":53,"title":54,"published_at":55},"ai-powered-credential-harvesting-campaign-steals-thousands-of-api-keys-in-hours","AI-Powered Credential Harvesting Campaign Steals Thousands of API Keys in Hours","2026-09-08T16:23:03.704+00:00",{"slug":57,"title":58,"published_at":59},"oauth-consent-phishing-bypasses-mfa-to-hijack-cloud-accounts","OAuth Consent Phishing Bypasses MFA to Hijack Cloud Accounts","2026-09-01T22:20:28.484+00:00",{"slug":61,"title":62,"published_at":63},"russian-apt-groups-hijack-accounts-via-oauth-abuse-and-social-engineering","Russian APT Groups Hijack Accounts via OAuth Abuse and Social Engineering","2026-08-20T22:21:29.393+00:00",{"slug":65,"title":66,"published_at":67},"kali365-abuses-microsoft-device-code-auth-to-hijack-enterprise-accounts","Kali365 Abuses Microsoft Device Code Auth to Hijack Enterprise Accounts","2026-08-05T14:21:53.521+00:00",[69,74,79,84,89,94],{"slug":70,"name":71,"problem":72,"stories":73},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",27,{"slug":75,"name":76,"problem":77,"stories":78},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",26,{"slug":80,"name":81,"problem":82,"stories":83},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",21,{"slug":85,"name":86,"problem":87,"stories":88},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",8,{"slug":90,"name":91,"problem":92,"stories":93},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",4,{"slug":95,"name":96,"problem":97,"stories":98},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",3,[100,106,112,118,123,128,133,137],{"family":101,"item":102,"code":103,"title":104,"together":105},"gdpr","32","Article 32","Security of processing",31,{"family":107,"item":108,"code":109,"title":110,"together":111},"cis","6","Control 6","Access Control Management",29,{"family":113,"item":114,"code":115,"title":116,"together":117},"nist-800-53","ac-17","AC-17","Remote Access",28,{"family":107,"item":119,"code":120,"title":121,"together":122},"14","Control 14","Security Awareness and Skills Training",23,{"family":5,"item":124,"code":125,"title":126,"together":127},"t1566","T1566","Phishing",22,{"family":129,"item":130,"code":131,"title":132,"together":127},"nist-sp","800-63","SP 800-63","SP 800-63: Digital Identity Guidelines",{"family":107,"item":134,"code":135,"title":136,"together":127},"4","Control 4","Secure Configuration of Enterprise Assets and Software",{"family":113,"item":138,"code":139,"title":140,"together":141},"ac-2","AC-2","Account Management",20]