Topic starter
07/03/2026 1:37 am
TL;DR: Token theft lets attackers replay OAuth and session tokens after successful login, bypassing passwords and MFA, while refresh tokens can survive resets and keep access alive, according to Obsidian Security. The practical lesson is that token lifecycle control and behavioral detection matter more than authentication events alone.
Editorial analysis by NHI Mgmt Group, based on content published by Obsidian Security: “Token-Based Attacks: How Attackers Bypass MFA”.
By the numbers:
- AiTM phishing attacks increased 146% over the past year.
- Token theft accounted for 31% of Microsoft 365 breaches in 2025.
Key questions
Q: What breaks when OAuth tokens are stolen through a legitimate login flow?
A: Password-based phishing controls lose much of their value because the victim authenticates on real infrastructure and the attacker captures the token instead of a password.
Q: Why do refresh tokens make token theft harder to contain than password theft?
A: Refresh tokens can mint new access tokens long after passwords are changed or MFA is reset.
Q: How should security teams detect token theft without relying on failed login alerts?
A: Use behavioural signals such as location shifts, ASN changes, User-Agent changes, impossible session combinations, and unusual data-access volume.
Practitioner guidance
- Audit OAuth grants and delegated access Inventory third-party OAuth grants, service connections, and high-scope integrations.
- Implement behavioural detection for token replay Monitor IP deviation, User-Agent changes, geolocation anomalies, bulk downloads, and unusual API call patterns because stolen tokens often look like valid sessions.
- Shorten token exposure with explicit revocation checks Verify that logout, password reset, MFA reset, and account suspension actually invalidate active refresh paths and token stores across major applications.
Bottom line: Token theft succeeds because bearer tokens remain valid after authentication, so the compromise is in post-login access rather than password cracking.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 4:31 pm
Token lifecycle, not authentication success, is now the decisive control surface: MFA proves identity at login, but bearer tokens move the trust decision to possession and validity. That means the real governance problem is whether organisations can see, bind, revoke, and re-evaluate tokens after issuance. The practical conclusion is that authentication assurance and access assurance are no longer the same thing.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: When is MFA no longer enough to protect SaaS and cloud access?
A: MFA is necessary at login, but it is not sufficient once bearer tokens, OAuth grants, and refresh paths exist. If your environment relies on long-lived sessions, delegated integrations, or third-party apps, then post-login token governance becomes the control that actually limits abuse. Strong authentication and strong session governance must work together.
👉 Read our full editorial: Token theft bypasses MFA by turning bearer tokens into access