MFA Token Theft

MFA token theft is the capture of a second-factor code, push approval, or session token during a phishing interaction. It matters because it allows attackers to bypass a password alone and complete sign-in as the victim, even when multifactor authentication is enabled.

Expanded Definition

MFA token theft is broader than password phishing because the attacker is not trying to guess a credential, but to capture the proof that a sign-in challenge was already satisfied. In NHI and IAM environments, that proof can be a one-time code, an approval in an authenticator app, or a reusable session token that continues to grant access after the original login moment. Definitions vary across vendors on whether the term should include only real-time interception or also post-authentication token replay, but the operational risk is the same: the attacker inherits an authenticated session rather than breaking into it.

This distinction matters for service accounts, admin workflows, and agentic systems that rely on delegated access. Guidance from the NIST Cybersecurity Framework 2.0 reinforces the need to detect, contain, and recover from identity compromise, which is exactly where token theft sits. The most common misapplication is treating MFA token theft as a password problem, which occurs when teams rotate credentials but leave stolen tokens, device trust, or active sessions untouched.

Examples and Use Cases

Implementing defenses against MFA token theft rigorously often introduces friction in user authentication, requiring organisations to weigh login convenience against stronger resistance to phishing and session replay.

• A user approves a push notification during a phishing call, and the attacker immediately uses the resulting session to access email or a cloud console.
• A stolen browser session token is replayed from a different device, bypassing the original second factor because the token is still valid.
• An OAuth or SSO flow is abused so that the attacker captures an access token after the victim completes authentication.
• In a support incident, an attacker persuades a target to share a one-time code, then uses it before expiration to establish a live session.
• In an NHI environment, a compromised delegated session can let an agent or automation account continue calling APIs even after the initial user is alerted.

Real-world cases show how quickly token abuse turns into broader compromise. NHIMG has documented token-centric incidents in the Salesloft OAuth token breach and the CoPhish OAuth Token Theft via Copilot Studio, where the issue was not password failure but trust in an already-issued token.

Why It Matters in NHI Security

MFA token theft is especially dangerous in NHI security because many non-human workflows depend on durable credentials, delegated sessions, or tool access that can outlive the original human interaction. Once an attacker steals a token, they may not need to brute-force anything else; they can move laterally, invoke APIs, and impersonate trusted automation until the token expires or is revoked. NHIMG research shows that 44% of NHI tokens are exposed in the wild, being sent or stored across collaboration tools and code systems, which increases the chance that one theft event becomes a cross-system compromise. The same pattern appears in the Guide to the Secret Sprawl Challenge, where exposure often begins with poor handling rather than sophisticated intrusion.

For governance, the lesson is that MFA alone does not end authentication risk. Teams need token binding, short lifetimes, conditional access, and rapid revocation paths that cover both users and NHIs. Organisational failures usually become visible only after suspicious inbox access, unusual API activity, or a cloud incident forces session invalidation, at which point MFA token theft becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• How should security teams detect token theft if MFA was already completed?
• What is the difference between token theft and privilege escalation in managed identity attacks?
• What is the difference between credential theft and token theft?
• When does token theft create more risk than password theft?