The rise of token-theft attacks: No password or MFA needed
Threat actors continue to find new ways to use stolen tokens to compromise protected systems. AI only makes it easier for them.
Attackers can access Microsoft 365 accounts -- reaching Outlook, Teams and OneDrive -- without needing a password or completing MFA challenges. But how?
Using an emerging phishing-as-a-service platform called Kali365, which was first seen in April 2026, malicious hackers capture OAuth tokens and gain persistent access to targeted entities' Microsoft 365 environments.
"Kali365 lowers the barrier of entry, providing less-technical attackers access to AI-generated phishing lures, automated campaign templates, real-time targeted individual/entity tracking dashboards, and OAuth token capture capabilities," the FBI wrote in a May bulletin.
The FBI's warning came just months after another high-level incident involving token theft. In 2025, Google's Threat Intelligence Group reported that a threat actor targeted organizations using compromised OAuth tokens associated with Salesloft Drift, an application with Salesforce integrations that has since been sunsetted.
These two incidents prove that token theft remains a significant and adjustable cybersecurity threat. When bad actors steal session tokens or digitally encrypted keys from authorized and authenticated users, they can use them to access accounts or systems.
Most common means of token theft
Token theft occurs when an attacker steals a session token after the user has already logged into a system.
"The attacker can be with you without ever needing a password or passing MFA or anything else," said George Gerchow, a faculty member at IANS and CSO of Bedrock Data. "MFA closed the password door, so attackers moved to the token. They do not beat MFA -- they steal something that has already passed it. And from an attacker perspective, it's pretty simple to do."
In other words, attackers use token theft as a conduit into the organization's digital environment, where they can then use that initial access to advance their attack objectives -- whether that's to steal data or disrupt the organization in other ways.
Token theft typically happens using one of five methods. First is malware on the endpoint. Here, Gerchow said, the attacker "comes in through a third-party package, a user click or a compromised download, then reads the browser's cookie store straight off disc."
Another method is adversary-in-the-middle phishing. "A proxy relays the real login page in real time, the victim passes real MFA and the proxy catches the token on the way back," Gerchow explained.
The third way involves malicious browser extensions. "An extension that has been granted broad permissions reads the session from inside the browser, where nothing looks unusual. This is the primary scaling vector right now and the highest current risk surface, especially the AI-driven extensions," he said.
Another attack strategy is live-session abuse, where an attacker already inside uses someone's logged-in session to mint a new token rather than copying the existing one. The fifth method is social-engineering attacks aimed at the IT help desk. "Call, sound convincing, get a reset, receive a perfectly legitimate token. No malware, no exploit," Gerchow said.
Defending against token-based attacks
When malicious actors steal a token, they potentially have access to what you have access to, said Chris Boehm, field CTO at Zero Networks. Additionally, token theft is hard to detect, he said, adding that "from a security perspective, most times it looks normal."
As a result, security teams might only discover their organization is a victim of token theft after attackers try to access a database or system that the victimized user had never accessed before. More often, though, attackers use the access gained from the stolen tokens to "get to someone who has elevated privileges," Boehm explained. "[The initial token theft is] a catalyst to get them where they need to go. It creates opportunities. It allows them to get into your ecosystem to steal other things."
While monitoring and detecting capabilities are critical to guard against such escalation, security experts stressed the need for adequate defensive measures to prevent token theft.
That involves adding authentication layers, which also adds layers of friction. It also means implementing and maturing a zero-trust security strategy, as well as ensuring other longstanding security best practices, such as user training, are in place, said Chris Kapusta, vice president of advisory and transformation at GDT, a technology services provider.
"We still see the user being the weakest link in a lot of these exploits, so user awareness is critical," he said, stressing the need for security training that teaches employees how to spot and guard against the techniques used to steal tokens.
As is the case with everything in security, there's no single defense that addresses all token theft attack techniques. To prevent token theft enabled by malware, Gerchow emphasized the need to prevent the delivery of malicious third-party packages. "Stopping it means scanning public repositories for malicious packages, which most organizations still do not do, even though the native tooling exists in most repositories," he said.
To counteract adversary-in-the-middle phishing, security teams should insist on user awareness training. "Make it interactive and pitch it at the maturity of the room. Start by asking people what token theft even is, so you know what you are working with," Gerchow said.
The same goes for addressing social engineering aimed at the help desk. Gerchow suggested following a clear identity-verification protocol before any password or credential action occurs, ideally using a number from the organization's directory. As for defending against malicious browser extensions, Gerchow advised auditing and restricting installed extensions.
Organizations can also consider using AI, Gerchow added. "Use AI-native tooling to ask questions of your own environment at scale. Point a model at your browser sessions, correlate against the SIEM and have it tell you where your token theft exposure actually is."
Balancing security and efficiency
Token theft emerged around 1990, but became a significant threat with the rise of high-speed internet, widescale connectivity and the shift to web browsers. Its prevalence rose further as organizations expanded their use of digital systems, adopted cloud computing and enabled more remote access. The result was a digital world where verifying identity and the use of tokens became essential for access and authentication control.
At the same time, Boehm said, IT and security leaders must constantly weigh the pros and cons of adding more friction. They recognize the need to adequately protect against token theft and other attacks, but shouldn't impede the ease and pace of doing business.
AI and other factors might change the calculus used to ensure the right balance, Kapusta said. "Bad actors have access to AI that helps them launch attacks, including token theft," he said. "It's becoming far easier for the bad actors to generate attacks and identify [and weaponize] exploits."
Mary K. Pratt is an award-winning freelance journalist with a focus on covering enterprise IT and cybersecurity management.
