T1550.001_application-access-token - Use stolen application access tokens for authentication bypass
Use stolen application access tokens to bypass authentication and access restricted accounts, information, or services.
Tags
Updated: 2026-05-28Capabilities
Typical Inputs
Typical Outputs
What this skill does
- steal application access tokens
- bypass authentication process
- access restricted accounts
- access restricted information
- access restricted services
- authorize API requests
- use OAuth access token
- search emails
- enumerate contacts
- trigger password reset
- request short-lived access token
- request data with token
- perform actions with token
- create federated user session
Inputs
- target environment
- SaaS systems
- containers systems
- IaaS systems
- OAuth access token
- cloud email service
- user account
- refresh token
- REST API
- AWS API credentials
- AWS API call
- user permissions
- cloud account
- user credentials
- service provider
- network perimeter
- audit logs
- third-party applications
- corporate policies
- user email
Outputs
- access to resources
- long-term access to features
- extended access to services
- short-lived access token
- data from services
- actions performed by user
- federated user session
- audit reports
- encrypted email communications
Requirements
- SaaS environment
- containers environment
- IaaS environment
- Office Suite
- Identity Provider
- OAuth framework
- AWS environment
- GCP environment
- user permissions
- data perimeter
- token binding strategy
- file encryption