[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1550-001":3},{"item":4,"lessons":18,"controls":64,"related":93},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1550-001","T1550.001","Application Access Token",11,"MITRE","**What attackers do.** Attackers reuse stolen application access tokens, such as OAuth tokens, to call APIs and access cloud services without logging in again. This lets them bypass passwords and MFA and serves Defence Evasion and Lateral Movement.\n\n**How to defend.** Shorten token lifetimes, use conditional access and token binding where available, and make sure incident response includes revoking tokens and refresh tokens, not just resetting passwords. Review applications and service principals with broad API permissions. Collect cloud audit and sign-in logs that record token use.\n\n**Signs to look for.** Look for API activity from IP addresses or locations unlike the user's normal ones, token use continuing after a password reset, and high-volume mailbox or file access through APIs. A common gap is incomplete logging of non-interactive sign-ins.","Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials.\n\nApplication access tokens are used to make authorized API requests on behalf of a user or service and are commonly used to access resources in cloud, container-based applications, and software-as-a-service (SaaS). \n\nOAuth is one commonly implemented framework that issues tokens to users for access to systems. These frameworks are used collaboratively to verify the user and determine what actions the user is allowed to perform. Once identity is established, the token allows actions to be authorized, without passing the actual credentials of the user. Therefore, compromise of the token can grant the adversary access to resources of other sites through a malicious application.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1550\u002F001\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60],{"slug":21,"title":22,"published_at":23},"browser-based-attacks-bypass-edr-by-exploiting-legitimate-sessions","Browser-Based Attacks Bypass EDR by Exploiting Legitimate Sessions","2026-10-02T16:21:18.74+00:00",{"slug":25,"title":26,"published_at":27},"browser-based-attacks-in-2026-phishing-extensions-oauth-abuse","Browser-Based Attacks in 2026: Phishing, Extensions & OAuth Abuse","2026-09-30T14:21:41.55+00:00",{"slug":29,"title":30,"published_at":31},"mfa-is-not-enough-oauth-consent-abuse-bypasses-authentication-controls","MFA Is Not Enough: OAuth Consent Abuse Bypasses Authentication Controls","2026-09-18T20:20:44.491+00:00",{"slug":33,"title":34,"published_at":35},"it-impersonation-via-microsoft-teams-fuels-vishing-ransomware-and-oauth-attacks","IT Impersonation via Microsoft Teams Fuels Vishing, Ransomware, and OAuth Attacks","2026-09-03T20:20:56.731+00:00",{"slug":37,"title":38,"published_at":39},"apt29-hijacks-hotel-wi-fi-to-deliver-fake-updates-and-steal-credentials","APT29 Hijacks Hotel Wi-Fi to Deliver Fake Updates and Steal Credentials","2026-08-01T08:20:34.539+00:00",{"slug":41,"title":42,"published_at":43},"hollowgraph-malware-hijacks-microsoft-365-calendars-for-stealthy-cc","HollowGraph Malware Hijacks Microsoft 365 Calendars for Stealthy C&C","2026-07-21T12:20:24.99+00:00",{"slug":45,"title":46,"published_at":47},"project-cav3rn-hijacks-outlook-calendar-dns-for-stealthy-c2-communication","Project CAV3RN Hijacks Outlook Calendar & DNS for Stealthy C2 Communication","2026-07-21T10:21:24.57+00:00",{"slug":49,"title":50,"published_at":51},"hollowgraph-malware-abuses-microsoft-graph-api-for-covert-c2-via-calendar-events","HollowGraph Malware Abuses Microsoft Graph API for Covert C2 via Calendar Events","2026-07-20T18:20:26.927+00:00",{"slug":53,"title":54,"published_at":55},"shinyhunters-abuses-oauth-and-supply-chain-integrations-to-compromise-saas-environments","ShinyHunters Abuses OAuth and Supply Chain Integrations to Compromise SaaS Environments","2026-07-14T00:20:24.944+00:00",{"slug":57,"title":58,"published_at":59},"entra-id-abuse-legitimate-features-used-for-data-exfiltration","Entra ID Abuse: Legitimate Features Used for Data Exfiltration","2026-07-13T16:21:44.698+00:00",{"slug":61,"title":62,"published_at":63},"umbrij-malware-hijacks-oauth-tokens-via-browser-debug-ports-to-steal-gmail-data","Umbrij Malware Hijacks OAuth Tokens via Browser Debug Ports to Steal Gmail Data","2026-07-02T14:20:26.049+00:00",[65,70,75,80,84,89],{"slug":66,"name":67,"problem":68,"stories":69},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",7,{"slug":71,"name":72,"problem":73,"stories":74},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",5,{"slug":76,"name":77,"problem":78,"stories":79},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",4,{"slug":81,"name":82,"problem":83,"stories":79},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":85,"name":86,"problem":87,"stories":88},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",2,{"slug":90,"name":91,"problem":92,"stories":88},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[94,99,105,111,115,119,123,127],{"family":95,"item":96,"code":97,"title":98,"together":9},"gdpr","32","Article 32","Security of processing",{"family":100,"item":101,"code":102,"title":103,"together":104},"cis","6","Control 6","Access Control Management",9,{"family":106,"item":107,"code":108,"title":109,"together":110},"nist-800-53","ac-17","AC-17","Remote Access",8,{"family":106,"item":112,"code":113,"title":114,"together":74},"si-3","SI-3","Malicious Code Protection",{"family":100,"item":116,"code":117,"title":118,"together":74},"8","Control 8","Audit Log Management",{"family":106,"item":120,"code":121,"title":122,"together":74},"au-12","AU-12","Audit Record Generation",{"family":100,"item":124,"code":125,"title":126,"together":74},"4","Control 4","Secure Configuration of Enterprise Assets and Software",{"family":106,"item":128,"code":129,"title":130,"together":79},"ac-2","AC-2","Account Management"]