Do you like to learn more about tokens and ways to protect them in #MicrosoftEntra? Join my #TECTalk on January 23rd to explore the various kind of token artifacts, post authentication attacks and mitigations to prevent #TokenTheft. Register for free at www.quest.com/event/the-ex...
November 27, 2024 at 6:55 PM
Do you like to learn more about tokens and ways to protect them in #MicrosoftEntra? Join my #TECTalk on January 23rd to explore the various kind of token artifacts, post authentication attacks and mitigations to prevent #TokenTheft. Register for free at www.quest.com/event/the-ex...
Am 11.04.2025 findet die #ExpertsLiveDE in Leipzig statt, mit vielen spannenden Vorträgen zu Cloud, Workplace, AI und Security. Ich freue mich sehr, dieses Jahr dabei sein zu dürfen und über #TokenTheft in #MicrosoftEntra sprechen zu dürfen. Weitere Infos sowie Tickets: www.expertslive.de
December 17, 2024 at 6:07 AM
Am 11.04.2025 findet die #ExpertsLiveDE in Leipzig statt, mit vielen spannenden Vorträgen zu Cloud, Workplace, AI und Security. Ich freue mich sehr, dieses Jahr dabei sein zu dürfen und über #TokenTheft in #MicrosoftEntra sprechen zu dürfen. Weitere Infos sowie Tickets: www.expertslive.de
A Microsoft-signed app can pop the real login screen and steal your OAuth token anyway. https://intel.threadlinqs.com/threat/TL-2026-2628 #ThreatIntel #askWAM #OAuth #TokenTheft
September 23, 2026 at 2:02 PM
A Microsoft-signed app can pop the real login screen and steal your OAuth token anyway. https://intel.threadlinqs.com/threat/TL-2026-2628 #ThreatIntel #askWAM #OAuth #TokenTheft
Attackers hijack active session tokens. OAuth theft in 2025 let criminals bypass MFA and infiltrate SaaS like Salesforce and M365. Detection is nearly impossible as they appear legitimate. #IdentitySecurity #TokenTheft #CyberThreats #MFA
January 19, 2026 at 6:00 PM
Attackers hijack active session tokens. OAuth theft in 2025 let criminals bypass MFA and infiltrate SaaS like Salesforce and M365. Detection is nearly impossible as they appear legitimate. #IdentitySecurity #TokenTheft #CyberThreats #MFA
Prevent token replay attacks with token protection. Even if malware copies your session token, attackers can't use it to access your cloud storage or confidential documents. Check it out: youtu.be/gPcNlm0CyOw #TokenProtection #tokentheft #microsoft365 #microsoft #microsoftazure
March 21, 2025 at 6:38 PM
Prevent token replay attacks with token protection. Even if malware copies your session token, attackers can't use it to access your cloud storage or confidential documents. Check it out: youtu.be/gPcNlm0CyOw #TokenProtection #tokentheft #microsoft365 #microsoft #microsoftazure
Previously, these details were only available in XDR Hunting table "AADSignInEventsBeta", Portal and/or Graph API. These added properties offer the opportunity to write new analytics rules and hunting queries, for example in the area of #TokenTheft. (2/3)
learn.microsoft.com/en-us/azure/...
learn.microsoft.com/en-us/azure/...
Azure Monitor Logs reference - SigninLogs - Azure Monitor
Reference for SigninLogs table in Azure Monitor Logs.
learn.microsoft.com
February 11, 2025 at 5:31 PM
Previously, these details were only available in XDR Hunting table "AADSignInEventsBeta", Portal and/or Graph API. These added properties offer the opportunity to write new analytics rules and hunting queries, for example in the area of #TokenTheft. (2/3)
learn.microsoft.com/en-us/azure/...
learn.microsoft.com/en-us/azure/...
Protect data by ensuring tokens are bound to your device, preventing attackers from reusing stolen tokens and compromising your resources. Start here. #TokenProtection officegarageitpro.medium.co... #tokentheft #microsoft365 #microsoft #microsoftazure #sessiontokens
Token theft protection with Microsoft Entra, Intune, Defender XDR & Windows
Prevent attackers from stealing your identity and data by protecting your tokens. In single sign-on systems like SAML and OAUTH, tokens are...
officegarageitpro.medium.com
May 28, 2025 at 6:38 PM
Protect data by ensuring tokens are bound to your device, preventing attackers from reusing stolen tokens and compromising your resources. Start here. #TokenProtection officegarageitpro.medium.co... #tokentheft #microsoft365 #microsoft #microsoftazure #sessiontokens
Protect data by ensuring tokens are bound to your device, preventing attackers from reusing stolen tokens and compromising your resources. Start here. #TokenProtection officegarageitpro.medium.co... #tokentheft #microsoft365 #microsoft #microsoftazure #sessiontokens
Token theft protection with Microsoft Entra, Intune, Defender XDR & Windows
Prevent attackers from stealing your identity and data by protecting your tokens. In single sign-on systems like SAML and OAUTH, tokens are...
officegarageitpro.medium.com
April 30, 2025 at 1:04 PM
Protect data by ensuring tokens are bound to your device, preventing attackers from reusing stolen tokens and compromising your resources. Start here. #TokenProtection officegarageitpro.medium.co... #tokentheft #microsoft365 #microsoft #microsoftazure #sessiontokens
Protect data by ensuring tokens are bound to your device, preventing attackers from reusing stolen tokens and compromising your resources. Start here. #TokenProtection officegarageitpro.medium.co... #tokentheft #microsoft365 #microsoft #microsoftazure #sessiontokens
Token theft protection with Microsoft Entra, Intune, Defender XDR & Windows
Prevent attackers from stealing your identity and data by protecting your tokens. In single sign-on systems like SAML and OAUTH, tokens are...
officegarageitpro.medium.com
February 13, 2025 at 5:38 PM
Protect data by ensuring tokens are bound to your device, preventing attackers from reusing stolen tokens and compromising your resources. Start here. #TokenProtection officegarageitpro.medium.co... #tokentheft #microsoft365 #microsoft #microsoftazure #sessiontokens
What Is Token Theft? The Theme-Park Pass Explained: What actually is a session token, and why do attackers want it? Think of it like a theme-park pass: whoever holds it gets the rides — so if someone steals it after you sign in, they get… MSFTMechanics #CyberSecurity #TokenTheft #IdentitySecurity
What Is Token Theft? The Theme-Park Pass Explained
What actually is a session token, and why do attackers want it? Think of it like a theme-park pass: whoever holds it gets the rides — so if someone steals it after you sign in, they get your access without your password.
Full explainer: https://www.youtube.com/watch?v=gPcNlm0CyOw
#CyberSecurity #IdentitySecurity #MicrosoftEntra #TokenTheft #ITpro
www.youtube.com
September 14, 2026 at 3:21 PM
What Is Token Theft? The Theme-Park Pass Explained: What actually is a session token, and why do attackers want it? Think of it like a theme-park pass: whoever holds it gets the rides — so if someone steals it after you sign in, they get… MSFTMechanics #CyberSecurity #TokenTheft #IdentitySecurity
Token Theft Attacks Jumped 111% — Why MFA Alone Won't Save You: MFA is essential — but is it enough? As more orgs turn on MFA, attackers pivot to credential-bypass attacks like token theft: Microsoft detected 147,000 token-theft attacks in a… MSFTMechanics #CyberSecurity #MicrosoftEntra #TokenTheft
Token Theft Attacks Jumped 111% — Why MFA Alone Won't Save You
MFA is essential — but is it enough? As more orgs turn on MFA, attackers pivot to credential-bypass attacks like token theft: Microsoft detected 147,000 token-theft attacks in a single year — a 111% jump — and the trend keeps climbing.
Here's how to defend against it: https://www.youtube.com/watch?v=gPcNlm0CyOw
Note: The 147,000 / 111% figures are from the source video (2024) — accurate as stated, but this is illustrative of the trend, not this-year numbers.
#CyberSecurity #MicrosoftEntra #TokenTheft #MFA #ITpro
www.youtube.com
September 13, 2026 at 11:37 AM
Token Theft Attacks Jumped 111% — Why MFA Alone Won't Save You: MFA is essential — but is it enough? As more orgs turn on MFA, attackers pivot to credential-bypass attacks like token theft: Microsoft detected 147,000 token-theft attacks in a… MSFTMechanics #CyberSecurity #MicrosoftEntra #TokenTheft
Silent BO token theft is draining accounts while users sleep—no clicks, no commands, just credentials vanishing into the void. #AISecurity #PotatoThreats #TokenTheft #Infostealer
https://synapseglass.wordpress.com/2026/09/08/silent-ai-token-theft-drains-accounts-without-user-action/
https://synapseglass.wordpress.com/2026/09/08/silent-ai-token-theft-drains-accounts-without-user-action/
September 8, 2026 at 10:08 PM
Silent BO token theft is draining accounts while users sleep—no clicks, no commands, just credentials vanishing into the void. #AISecurity #PotatoThreats #TokenTheft #Infostealer
https://synapseglass.wordpress.com/2026/09/08/silent-ai-token-theft-drains-accounts-without-user-action/
https://synapseglass.wordpress.com/2026/09/08/silent-ai-token-theft-drains-accounts-without-user-action/
Silent AI token theft is draining accounts while users sleep—no clicks, no commands, just credentials vanishing into the void. #AISecurity #CyberThreats #TokenTheft #Infostealer
https://synapseglass.wordpress.com/2026/09/08/silent-ai-token-theft-drains-accounts-without-user-action/
https://synapseglass.wordpress.com/2026/09/08/silent-ai-token-theft-drains-accounts-without-user-action/
Silent AI token theft drains accounts without user action
Silent AI token theft drains accounts without user action
synapseglass.wordpress.com
September 8, 2026 at 9:56 PM
Silent AI token theft is draining accounts while users sleep—no clicks, no commands, just credentials vanishing into the void. #AISecurity #CyberThreats #TokenTheft #Infostealer
https://synapseglass.wordpress.com/2026/09/08/silent-ai-token-theft-drains-accounts-without-user-action/
https://synapseglass.wordpress.com/2026/09/08/silent-ai-token-theft-drains-accounts-without-user-action/
⚠️ Salesloft fallout grows:
- Stolen tokens affect Salesforce, Slack, Google Workspace, AWS, Azure & OpenAI
- Salesforce blocked Salesloft Drift
Are we putting too much trust in SSO tokens?
#SalesloftBreach #OAuthCompromise #AIChatbotSecurity #Drift #EnterpriseSecurity #TokenTheft #SaaSRisk
- Stolen tokens affect Salesforce, Slack, Google Workspace, AWS, Azure & OpenAI
- Salesforce blocked Salesloft Drift
Are we putting too much trust in SSO tokens?
#SalesloftBreach #OAuthCompromise #AIChatbotSecurity #Drift #EnterpriseSecurity #TokenTheft #SaaSRisk
September 2, 2025 at 1:27 PM
⚠️ Salesloft fallout grows:
- Stolen tokens affect Salesforce, Slack, Google Workspace, AWS, Azure & OpenAI
- Salesforce blocked Salesloft Drift
Are we putting too much trust in SSO tokens?
#SalesloftBreach #OAuthCompromise #AIChatbotSecurity #Drift #EnterpriseSecurity #TokenTheft #SaaSRisk
- Stolen tokens affect Salesforce, Slack, Google Workspace, AWS, Azure & OpenAI
- Salesforce blocked Salesloft Drift
Are we putting too much trust in SSO tokens?
#SalesloftBreach #OAuthCompromise #AIChatbotSecurity #Drift #EnterpriseSecurity #TokenTheft #SaaSRisk
Session cookies can be stolen and replayed by infostealer malware, bypassing MFA and granting unauthorized access without login alerts. Defenses include short sessions, device binding, and step-up authentication. #SessionSecurity #TokenTheft
Session Cookie Theft: You Showed Your ID at the Door. But Someone Else Has Your Room Key
Session cookie theft lets attackers bypass MFA by stealing and replaying browser session tokens, allowing unauthenticated access without triggering a login or MFA prompt. Effective defenses include shortening and rotating session lifetimes, device binding, continuous context evaluation, step-up authentication, and strong endpoint controls. #infostealers #OneLogin
www.hendryadrian.com
April 16, 2026 at 2:45 AM
Session cookies can be stolen and replayed by infostealer malware, bypassing MFA and granting unauthorized access without login alerts. Defenses include short sessions, device binding, and step-up authentication. #SessionSecurity #TokenTheft
Sekoia TDR uncovered EvilTokens, a new Phishing-as-a-Service targeting Microsoft device code flows with turnkey phishing pages and backend for token harvesting, PRT conversion, and post-compromise actions. #PhishingKit #TokenTheft #USA
New widespread EvilTokens kit: device code phishing as-a-service – Part 1
Sekoia discovered EvilTokens, a new Phishing-as-a-Service that provides turnkey Microsoft device code phishing pages and a full backend for token harvesting, PRT conversion, cookie generation, and post-compromise reconnaissance. The kit has been rapidly adopted by affiliates for BEC campaigns and is tracked across 1,000+ domains deployed via Cloudflare Workers and affiliate hosting. #EvilTokens #Microsoft365
www.hendryadrian.com
March 30, 2026 at 11:40 PM
Sekoia TDR uncovered EvilTokens, a new Phishing-as-a-Service targeting Microsoft device code flows with turnkey phishing pages and backend for token harvesting, PRT conversion, and post-compromise actions. #PhishingKit #TokenTheft #USA
Prevent token replay attacks with token protection. Even if malware copies your session token, attackers can't use it to access your cloud storage or confidential documents. Check it out: youtu.be/gPcNlm0CyOw #TokenProtection #tokentheft #microsoft365 #microsoft #microsoftazure
May 27, 2025 at 6:08 PM
Prevent token replay attacks with token protection. Even if malware copies your session token, attackers can't use it to access your cloud storage or confidential documents. Check it out: youtu.be/gPcNlm0CyOw #TokenProtection #tokentheft #microsoft365 #microsoft #microsoftazure
Prevent token replay attacks with token protection. Even if malware copies your session token, attackers can't use it to access your cloud storage or confidential documents. Check it out: youtu.be/gPcNlm0CyOw #TokenProtection #tokentheft #microsoft365 #microsoft #microsoftazure
April 29, 2025 at 4:38 PM
Prevent token replay attacks with token protection. Even if malware copies your session token, attackers can't use it to access your cloud storage or confidential documents. Check it out: youtu.be/gPcNlm0CyOw #TokenProtection #tokentheft #microsoft365 #microsoft #microsoftazure
Protect data by ensuring tokens are bound to your device, preventing attackers from reusing stolen tokens and compromising your resources. Start here. #TokenProtection officegarageitpro.medium.co... #tokentheft #microsoft365 #microsoft #microsoftazure #sessiontokens
Token theft protection with Microsoft Entra, Intune, Defender XDR & Windows
Prevent attackers from stealing your identity and data by protecting your tokens. In single sign-on systems like SAML and OAUTH, tokens are...
officegarageitpro.medium.com
March 24, 2025 at 1:04 PM
Protect data by ensuring tokens are bound to your device, preventing attackers from reusing stolen tokens and compromising your resources. Start here. #TokenProtection officegarageitpro.medium.co... #tokentheft #microsoft365 #microsoft #microsoftazure #sessiontokens
Prevent token replay attacks with token protection. Even if malware copies your session token, attackers can't use it to access your cloud storage or confidential documents. Check it out: youtu.be/gPcNlm0CyOw #TokenProtection #tokentheft #microsoft365 #microsoft #microsoftazure
February 13, 2025 at 7:08 PM
Prevent token replay attacks with token protection. Even if malware copies your session token, attackers can't use it to access your cloud storage or confidential documents. Check it out: youtu.be/gPcNlm0CyOw #TokenProtection #tokentheft #microsoft365 #microsoft #microsoftazure
Microsoft 365 Android apps had a flaw exposing user tokens; update now to stay secure. #Microsoft365 #Android #Security #Vulnerability #TokenTheft #Cybersecurity #AppUpdate thedailytechfeed.com/microsoft-36...
June 3, 2026 at 3:08 PM
Microsoft 365 Android apps had a flaw exposing user tokens; update now to stay secure. #Microsoft365 #Android #Security #Vulnerability #TokenTheft #Cybersecurity #AppUpdate thedailytechfeed.com/microsoft-36...
Do you want to learn more about token protection and how to enforce it in Microsoft Entra ID? Read my latest blog post! www.cswrld.com/2024/04/micr... #entraid #authentication #tokenprotection #tokentheft #conditionalaccess #cybersecurity #tips
Microsoft Entra ID Token Protection explained | Cybersecurity World
Token Protection in Microsoft Entra ID protects tokens from token theft attacks by ensuring that tokens cannot be used on other devices.
www.cswrld.com
April 10, 2024 at 11:35 AM
Do you want to learn more about token protection and how to enforce it in Microsoft Entra ID? Read my latest blog post! www.cswrld.com/2024/04/micr... #entraid #authentication #tokenprotection #tokentheft #conditionalaccess #cybersecurity #tips
“Mum I lost my keys” 🥲
You’d be in trouble back then, even more so now if you lost one of these bad boys. Always have a backup, or backup of backup if you want to be extra cautious. #tokentheft #aitmphising #cybersecurity #m365security
You’d be in trouble back then, even more so now if you lost one of these bad boys. Always have a backup, or backup of backup if you want to be extra cautious. #tokentheft #aitmphising #cybersecurity #m365security
May 10, 2026 at 6:12 AM
“Mum I lost my keys” 🥲
You’d be in trouble back then, even more so now if you lost one of these bad boys. Always have a backup, or backup of backup if you want to be extra cautious. #tokentheft #aitmphising #cybersecurity #m365security
You’d be in trouble back then, even more so now if you lost one of these bad boys. Always have a backup, or backup of backup if you want to be extra cautious. #tokentheft #aitmphising #cybersecurity #m365security
December 5, 2024 at 1:02 AM