Why Tokens Are Like Gold for Opportunistic Threat Actors

Authentication/session tokens are being actively targeted by threat actors — stolen via AitM, pass-the-cookie, and synced browser credentials — enabling broad access to corporate SaaS and IdP-integrated systems without MFA. The report cites Okta and Cloudflare incidents and a Microsoft token-signing misuse that exposed large volumes of data, warns that long-lived tokens extend attacker dwell time, and recommends aggressive token expiry and blocking personal-device or synced-credential access to reduce risk.