The surge in device-code phishing attacks highlights how threat actors are increasingly stealing passwords to target authentication sessions, tokens, and trust relationships that enable them to masquerade as legitimate users and maintain persistent access.
Compromised tokens and sessions allow attackers to operate within trusted identity environments, making malicious activity indistinguishable from legitimate user behavior. Device code phishing, for instance, exploits a legitimate sign-in process designed for devices with limited input capabilities, such as smart TVs and Internet of Things (IoT) devices. Attackers trick users into entering a code from a phishing email into a real Microsoft or Google authentication page, unknowingly authorizing the attacker’s session and granting account access. These attacks succeed even in environments with multifactor authentication (MFA) enabled because they target authenticated sessions rather than passwords themselves.
Traditional defenses, such as those for detecting stolen passwords, suspicious login attempts, or authentication failures, are less effective because attackers are operating with valid access tokens, not compromised credentials.
A Shift in Tactics
Other attacks targeting authentication tokens include stealing browser cookies and OAuth tokens, extracting API keys from compromised systems, and compromising single sign-on (SSO) platforms to gain valid session tokens that provide access to multiple connected services.
“The shift means the adversary arrives with valid credentials and a valid session. From the perspective of the application, the adversary looks exactly like the legitimate user,” says John Laliberte, CEO and Founder of ClearVector.
For defenders, the consequence is that the authentication itself is no longer the moment of truth; it is everything that happens after the login, he says.
“Defenders who anchor their security program on the front door — passwords, MFA prompts, conditional access at sign-in — are defending a checkpoint the adversary has already walked past,” Laliberte notes.
According to experts, attackers are increasingly shifting toward token theft and session hijacking because improved password security practices, including the growing adoption of MFA and password managers, have made traditional credential compromise more difficult. Tokens also enable more persistent access to accounts and allow attackers to avoid the password resets and MFA prompts that security teams typically monitor closely.
“As user authentication moves to device-bound passkeys that can’t be copied, attackers simply move to the next-easiest target: the session token, which is still a ‘copyable’ bearer credential almost everywhere,” notes Jasson Casey, CEO of Beyond Identity.
From Securing Logins to Protecting Authenticated Sessions
The bottom line is that identity can no longer be treated as a point-in-time verification. Instead of treating authentication as the finish line, security teams must treat it as the starting point and continuously validate trust throughout the entire session life cycle, advises Shane Barney, CISO at Keeper Security.
“The most common mistake is assuming that successful authentication equals ongoing trust. Many organizations invest heavily in securing the login process but have limited visibility into what happens afterward,” Barney notes.
Persistent sessions, excessive permissions, unmanaged OAuth integrations, long-lived tokens, and insufficient monitoring of privileged activity all create opportunities for attackers to operate undetected after gaining access. In many cases, organizations also struggle with identity sprawl across cloud platforms, software-as-a-service (SaaS) applications, and third-party services, making it difficult to maintain consistent access controls, he says.
According to Barney and others, defending against modern token theft attacks requires organizations to shift their focus from securing the login process to continuously protecting authenticated sessions.
Continuous Monitoring and Other Controls
This means being able to monitor post-authentication behavior for anomalies and limiting user privileges and third-party application permissions to minimize the impact of compromised sessions. Rather than relying solely on passwords and traditional MFA, organizations should adopt phishing-resistant authentication methods, such as FIDO2 security keys and passkeys, and bind authentication tokens to trusted devices to prevent token replay attacks. Also key is the need to continuously validate user and device risk throughout a session and to rapidly revoke compromised tokens.
“Organizations need to start treating sessions as requiring continuous validation, rather than granting continued access just because the user authenticated successfully at one point in time,” says Hayden Covington, associate director of security operations at Black Hills Information Security.
“The goal here is to monitor ongoing sessions for anomalies that suggest the person behind the session isn’t the user who started it,” he says,
The controls that actually defeat token theft, Covington notes, are phishing-resistant MFA and token protection, which bind tokens to a device so a stolen token is useless elsewhere. It’s also critical to layer strict conditional access and session risk policies on top of these measures, he says. As examples, he points to measures like blocking device code authentication that most users never need and flagging abnormal device attributes, such as a user who normally works on a Mac suddenly appearing on a Windows machine or initiating a session from an unexpected city.
“Organizations need to treat identity as a living thing, not a gate,” ClearVector’s Laliberte says.
That requires enabling visibility into what every identity — human, third-party, or machine — actually does after authentication.
“Nonhuman identities and third parties matter as much as humans here because OAuth abuse frequently rides on third-party trust relationships that no person ever reviews again,” he says.
Organizations also need to have the ability to map every action in production back to the originating identity, including all federated access.
“The question that matters is not, ‘Is this token valid?’ but, ‘Does this activity make sense for this identity?'” Laliberte points out.
The same shift from protecting credentials to protecting authenticated sessions also applies to incident response. The most common mistake at many organizations is failing to understand that resetting a password doesn’t kill active sessions, says Denis Calderone, CTO at Suzu Labs.
“We still have to walk clients through the fact that when you’re triaging a compromised account, you need to explicitly revoke all active refresh tokens as a separate step,” he adds.
A password reset alone leaves every existing session alive, and the attacker stays connected, Calderone points out.
“Organizations also need to ruthlessly cut permissions so that when a session is compromised, the blast radius is contained,” he says.
