Token Theft

Description

Tokens are mostly stolen in three ways. Malware on the device reads them straight from the browser store or from application memory. Adversary-in-the-middle phishing, where a fake page forwards your login to the real service in real time, catches the token at the moment the service issues it. The third way is intercepting the traffic between you and the service you are reaching. Once it is taken, the attacker no longer needs your password or your MFA — the token is enough.

The defense comes down to making a stolen token worth as little as possible. Short token lifetimes, binding a token to a specific device, conditional access that checks where the request comes from, and the ability to revoke a token — all of it narrows the window in which a stolen token has any value. It is worth understanding why token theft became popular: two-factor protection does not help once the token has been issued, so stealing it skips an otherwise very strong layer.

Examples

• A malicious browser extension reads your tokens out of storage and sends them to the attacker; they reach the services as the victim until the tokens expire.
• A fake login page forwards the input to the real service and, the moment the service returns a token, intercepts it — the user really is logged in, but the attacker holds a copy of the token.
• Alongside usernames and passwords, an infostealer on an infected machine also collects saved tokens from the browser.

Notes

• Two-factor authentication does not close the book on stolen access and stolen identity — the second factor protects the login, not the record that the user passed every step of verification.
• The shorter a token lives and the more tightly it is bound to a device, the less it is worth when stolen.