T1528 Steal Application Access Token — Detection & Response
Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources. Application access tokens — including OAuth tokens, service account keys, and API keys — are used by applications and users to authenticate to services without re-entering credentials. Stolen tokens grant the adversary the same access as the legitimate application or user, often bypassing MFA.
Coverage at a glance
- Detections shipped
- 4
- Avg. verdict time
- < 5 min
- Data sources
- 4+
Threat context
How adversaries use T1528 Steal Application Access Token — Detection & Response
Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources. Application access tokens — including OAuth tokens, service account keys, and API keys — are used by applications and users to authenticate to services without re-entering credentials. Stolen tokens grant the adversary the same access as the legitimate application or user, often bypassing MFA.
OAuth token theft is a primary technique in cloud-focused attacks. Adversaries obtain tokens through malicious OAuth app consent (illicit consent grant), phishing flows that capture device auth codes, or by extracting tokens from browser storage, environment variables, or CI/CD secrets. Once a valid token is captured, the adversary can access cloud services for the token's full validity period — often hours to days — without re-authenticating. MFA cannot stop token replay attacks, making token theft one of the most effective authentication bypass techniques in cloud environments.
Detections ManySignal ships
Ready-to-deploy detection rules
| Rule name | Severity | Data source |
|---|---|---|
| OAuth Access Token Used from New IP After Consent An OAuth access token granted during a consent flow is immediately used from a different IP than the consent-granting session — token interception indicator. | High | Entra ID / Microsoft 365 |
| Illicit Consent Grant — Third-Party App Requesting High-Privilege Scopes A new third-party application requests OAuth scopes including Mail.Read, Files.ReadWrite, or Calendars.ReadWrite from a non-admin user — common phishing app pattern. | High | Entra ID Audit Logs |
| Service Account Access Key Used from New Country An IAM access key or GCP service account key is used from a country with no prior access history for that credential — stolen key usage indicator. | Critical | AWS CloudTrail / GCP Audit |
| GitHub Personal Access Token Used from New IP A GitHub personal access token is authenticated from an IP not previously seen for that token — potential CI/CD secret or developer credential theft. | High | GitHub Audit Log |
Related techniques and tactics
T1078 Valid Accounts — Detection & Response
ATT&CK Technique
T1110 Brute Force — Detection & Response
ATT&CK Technique
T1566 Phishing — Detection & Response
ATT&CK Technique
T1059 Command and Scripting Interpreter — Detection & Response
ATT&CK Technique
T1053 Scheduled Task/Job — Detection & Response
ATT&CK Technique
T1548 Abuse Elevation Control Mechanism — Detection & Response
ATT&CK Technique
T1068 Exploitation for Privilege Escalation — Detection & Response
ATT&CK Technique
T1134 Access Token Manipulation — Detection & Response
ATT&CK Technique
T1098 Account Manipulation — Detection & Response
ATT&CK Technique
T1136 Create Account — Detection & Response
ATT&CK Technique
T1556 Modify Authentication Process — Detection & Response
ATT&CK Technique
T1621 Multi-Factor Authentication Request Generation — Detection & Response
ATT&CK Technique
T1528 Steal Application Access Token — Detection & Response: frequently asked questions
Why can't MFA stop stolen token attacks?
MFA protects the authentication event — the moment the user proves their identity. Once an access token is issued, it can be replayed without re-authenticating. Token theft bypasses MFA entirely because the token represents an already-completed authentication.
What is an illicit consent grant attack?
An attacker registers a malicious OAuth application and tricks a user into consenting to it via a phishing email. Once the user consents, the attacker receives a valid OAuth token with the consented scopes — no password needed.
How does ManySignal detect token theft from CI/CD pipelines?
CI/CD secrets (GitHub Actions secrets, CircleCI context variables) are environment variables injected at runtime. Malicious pipeline steps can extract and exfiltrate these. ManySignal detects the downstream usage anomaly: the token being used from a non-CI IP address.
What is the difference between T1528 and T1539 (Steal Web Session Cookie)?
T1528 targets application-layer API access tokens (OAuth, JWT, API keys). T1539 targets web session cookies that authenticate browser sessions. Both bypass MFA; T1528 is more relevant for API and machine-to-machine access, T1539 for browser-based SaaS access.
Can ManySignal detect device code phishing (OAuth device flow abuse)?
Yes. OAuth device flow phishing — where an attacker tricks a user into entering a device code to a legitimate Microsoft or Google OAuth page — results in a token being issued to the attacker's registered device. ManySignal detects the device code authentication event originating from an unexpected IP.
How does ManySignal handle token refresh events?
Token refresh events (OAuth refresh_token exchanged for a new access_token) appear in Entra ID and Okta logs. ManySignal monitors refresh events for location consistency and anomalous timing relative to the original access grant.
What is the risk from overly permissive OAuth scopes?
Overly permissive scopes mean a stolen token has more blast radius. ManySignal audits OAuth application scopes and alerts on newly granted applications requesting high-privilege scopes (mail read, calendar access, file system write).
Does ManySignal track token validity period?
ManySignal tracks the time delta between token issuance and usage. A token used many hours after issuance from a different location than issuance is flagged as a potential stolen token replay.
Can organisation-wide token revocation stop an active token theft attack?
Yes. ManySignal's response automation can trigger organisation-wide token revocation via Microsoft Graph API (revokeSignInSessions) or Okta's Session API. This terminates all active sessions for a compromised user.
Are workload identity tokens (e.g., Entra ID Managed Identity) at risk of T1528?
Managed Identity tokens are the more secure alternative — they cannot be extracted like static credentials. However, the services using them can still have their token endpoints queried if an attacker has code execution on the host. ManySignal detects IMDS endpoint access from unexpected processes.
See the agentic SOC in action
Watch AI agents work a real alert queue — verdicts, evidence, and confidence scores included. In-house SOC or MDR, your call.