Pass-the-PRT is an attack technique that reuses a stolen Primary Refresh Token to obtain access tokens without knowing the user’s password. It typically follows compromise of a device, browser session or cached token material. Defenders should protect endpoints, limit token lifetime exposure, monitor anomalous token use and revoke sessions after compromise.
How Pass-the-PRT Works
Pass-the-PRT is a token-reuse technique, not a password attack. An adversary who steals a Primary Refresh Token can often request new access tokens that look legitimate to downstream services, which makes the technique useful after endpoint or session compromise.
The key security property is that the attacker is abusing an already-issued trust artifact. That means the compromise path can bypass interactive sign-in checks, especially when the token was captured from a browser profile, device cache, or another authenticated session context.
Why It Is Dangerous
Because refresh tokens are designed to extend access without repeated password entry, theft turns a convenience mechanism into a persistence mechanism. If the stolen token is still valid, an attacker may continue accessing cloud services even after the original password is changed, until the token or session is explicitly revoked.
The technique is especially concerning when one compromised device or session can expose multiple applications, because the attacker does not need to defeat each target separately. NIST Cybersecurity Framework 2.0 is useful here because this threat sits at the intersection of protect, detect, respond and recover expectations for identity compromise.
How Organisations Check Exposure
Exposure starts with knowing where Primary Refresh Tokens can exist and where they might be harvested, including managed endpoints, browsers, remote sessions and cached credential material. Organisations should correlate device inventory, identity logs and cloud sign-in telemetry to find unusual token-based access patterns.
Vendor guidance matters because token handling and revocation behaviour can vary by platform. For identity assurance and authentication context, NIST SP 800-63 Digital Identity Guidelines helps frame why strong authentication is only part of the picture when long-lived token material is already present.
Detection, Recovery, and Containment
Defenders should look for access that continues from an unexpected device, geography, user agent, or session age, especially when sign-in appears valid but behaviour does not match the user. The safest response is to invalidate the token chain, revoke active sessions, isolate the affected endpoint, and review for follow-on access to mail, files, admin consoles, and API scopes.
When the attack path is cloud-heavy, MITRE ATT&CK Enterprise Matrix is a useful reference for mapping credential access, lateral movement, and post-compromise actions that often follow token theft. If the technique was enabled by weak session controls or excessive token reach, NIST SP 800-207 Zero Trust Architecture is the right lens for reducing implicit trust in reusable sessions.
Risk and Threat Considerations
Pass-the-PRT is dangerous because it converts a valid token into durable unauthorized access, often without triggering the same friction as a fresh login. The main threat is persistence: if the attacker keeps the token or can refresh it, the compromise can outlive the original entry point.
Failure mechanism: The attacker steals refresh-capable token material from an endpoint or browser context and uses it to mint new access tokens until the session chain is revoked or expires.
Impact: The attacker may retain access to cloud applications, inboxes, files, and administrative surfaces, and may pivot into broader identity compromise if monitoring and revocation are delayed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.CM-01 — Networks and systems are monitored to detect potential cybersecurity events | Pass-the-PRT requires monitoring abnormal token-based access patterns. |
| Recommendation — Monitor token reuse, unusual sessions, and post-compromise access patterns. | ||
| NIST SP 800-63 | 6.1 — Session Management | Primary refresh tokens are session material that can extend authenticated access. |
| Recommendation — Limit session lifetime and revoke token chains promptly after compromise. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Refresh tokens function as authenticator material that must be protected and lifecycle-managed. |
| Recommendation — Protect, rotate, and revoke token material when compromise is suspected. | ||
| MITRE ATT&CK | T1528 — Steal Application Access Token | Pass-the-PRT is a token-theft and token-reuse technique used to obtain access tokens. |
| Recommendation — Map token-theft detections to T1528 and hunt for downstream access. | ||
Practitioner Guidance
Why practitioners should care: Treat this as a session-security problem as much as an authentication problem. Password resets alone are often insufficient if the token chain is still trusted, so incident response should include session revocation and device review.
What to watch for: Prioritise anomalous token use from unfamiliar endpoints, unusual session persistence, and access that continues after the user believes they have been remediated. Those signals often distinguish token abuse from routine sign-in noise.
Practitioner takeaway: The most effective control is reducing token exposure at the endpoint and being ready to revoke trust fast when compromise is suspected.