T1528Steal Application Access Token
T1528 — Steal Application Access Token is a MITRE ATT&CK technique in the Credential Access tactic. Clankerusecase tracks 50 detection use cases covering it and 71 threat-intel articles citing it.
Credential Access
50Use cases
71Articles
0Sub-techniques
1Tactic
Use cases covering this technique (50)
OAuth consent / suspicious app grant [WEEKLY] Edge-service post-exploitation chain: internet-facing daemon → child shell or token redemption within 10 min of external request [WEEKLY] Install-Triggered Registry Publish or Git Push (Supply-Chain Worm Self-Propagation) [WEEKLY] npm-install spawned process performing cred-file fan-out plus IMDS reach [WEEKLY] OAuth Device-Code Consent Phish to Cross-IP Cloud Token Replay [WEEKLY] Package install lifecycle hook spawns interpreter that reads developer credential stores [WEEKLY] Package-manager install-time interpreter spawn with credential-file read and outbound egress within 120s [WEEKLY] Supply-chain repo credential theft → outbound exfil to attacker infra Azure AD Device Code Authentication Azure AD OAuth Application Consent Granted By User Azure AD User Consent Blocked for Risky Application Azure AD User Consent Denied for OAuth Application O365 File Permissioned Application Consent Granted by User O365 Mail Permissioned Application Consent Granted by User O365 User Consent Blocked for Risky Application O365 User Consent Denied for OAuth Application [LLM] new-api CVE-2026-64859: admin user-list/detail API access token disclosure scoping [LLM] new-api CVE-2026-64859: root-only /api/option config change following user-record access from same IP [LLM] Unauthenticated Flowise OAuth2 token-refresh endpoint access from external source (CVE-2026-70478) [LLM] Flowise mass OAuth token harvest — burst of successful refreshes across credentials [LLM] High-privilege OAuth consent grant to Flowise application (offline_access / Mail / Files) [LLM] Bun runtime executing Shai-Hulud Math_Symbol.js credential stealer [LLM] npm-install child process reading developer credential stores (keyv stealer) [LLM] Entra ID sign-in or session from Storm-2945 AiTM device-code phishing infrastructure [LLM] vault-secrets-webhook mints SA tokens via TokenRequest after admission (CVE-2026-54725) [LLM] Successful Entra ID device-code authentication (ARToken/EvilTokens PhaaS MFA bypass) [LLM] Recon tool reading K8s service-account token or /proc/self/environ inside a container [LLM] Spike of AADSTS50011 redirect_uri mismatch at IdP (poisoned Poweradmin callback) [LLM] Victim account takeover: new-IP sign-in within 1h of redirect_uri mismatch (CVE-2026-54588) [LLM] Leaked SA token / file contents in EnvoyExtensionPolicy status (CVE-2026-53713 disclosure) [LLM] TSDProxy x-tsdproxy-auth-token leaked to backend in upstream HTTP requests [LLM] Authorizer /authorize implicit-flow token leak to off-origin redirect_uri (CVE-2026-54072) [LLM] Authorizer /authorize redirect_uri iteration — multiple distinct targets from one source [LLM] Spike in Authorizer /authorize 302 redirects to off-origin hosts (bulk token exfiltration) [LLM] GitHub dead-drop C2 — commit-search for RevokeAndItGoesKaboom / TheBeautifulSandsOfTime [LLM] Salesforce API access bearing python-requests/aiohttp automation user-agent (Icarus OAuth abuse) [LLM] Salesforce connected-app OAuth access from first-seen ISP / anonymizing proxy (stolen-token reuse) [LLM] Malicious JetBrains Marketplace plugin install (15 DeepSeek/CodeGPT clone IDs) [LLM] Microsoft 365 OAuth device code authentication flow sign-in (EvilTokens) [LLM] EvilTokens device-code token polling from attacker infra (python-requests UA / C2 IPs) [LLM] Cloud credential file access by node/python runtime [LLM] s1ngularity Nx compromise: telemetry.js postinstall harvesting tokens via gh auth token [LLM] node child of npm/yarn/pnpm reading cloud and CI credential files (Miasma sweep) [LLM] Non-Codex-CLI node process reading ~/.codex/auth.json (Codex OAuth credential theft) [LLM] Package-manager process harvesting cloud metadata / Vault (IMDS 169.254.169.254, ECS 169.254.170.2, Vault :8200) [LLM] Python Process Reading Multi-Cloud Credential Stores (durabletask Stealer Stage) [LLM] Python process contacting AWS IMDS 169.254.169.254 (litellm stealer IAM credential theft) [LLM] In-cluster Kubernetes secret enumeration with Python user-agent (litellm stealer K8s pivot) [LLM] npm/node post-install (telemetry.js) spawning credential CLIs (gh auth token / npm whoami) — s1ngularity Nx [LLM] Reuse of CircleCI-exfiltrated secrets / stolen SSO session from breach attacker IPsArticles citing this technique (71)
crit Show, Don't Tell: What Evo Continuous Offensive Security Found in a Real Enterprise SaaS art-101
crit Compromised PyPI Package: mrmustard 0.7.4 Steals SSH, Cloud, and Kubernetes Credentials art-193
high Find Unused, Stale, and OIDC-Replaceable GitHub Actions Secrets Across Your GitHub Organization art-221
crit Begun, the Patch Wars have art-253
high Miasma supply chain attack: malicious code found in @redhat-cloud-services npm packages art-426
high The AntV Supply Chain Campaign Expands: Microsoft's `durabletask` PyPI Package Compromised art-468
high Microsoft's durabletask package on PyPi Compromised. Mini Shai Hulud attacks again... again! art-469
high "A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages art-515
high Malicious Release of elementary-data PyPI Package Steals Cloud Credentials from Data Engineers art-520
high Snyk Apps now GA: An easy, standardized, and secure framework for building custom integrations art-1511
crit API Security Guide art-1774