https://insinuator.net/tags/token-theft-series/ Recent content in Token Theft Series on Insinuator.net - Bold Statements Hugo en-us Mon, 17 Aug 2026 00:00:00 +0000 https://insinuator.net/2026/08/ernw-white-paper-80-token-theft-in-microsoft-entra-id-an-analysis-of-controls/ Mon, 17 Aug 2026 00:00:00 +0000 https://insinuator.net/2026/08/ernw-white-paper-80-token-theft-in-microsoft-entra-id-an-analysis-of-controls/ <p>While most attacks against cloud identities still rely on traditional password-based techniques, such as password spraying, credential stuffing, and brute-force attacks, these methods have become less effective as multi-factor authentication (MFA) has become more widespread. As a result, attackers are increasingly turning to token-based techniques, including token theft, adversary-in-the-middle (AiTM) attacks, device code phishing, and ConsentFix, which get around MFA instead of trying to break it.</p> <p>As one of the most widely deployed identity platforms, Microsoft Entra ID is a prime target for these evolving attack techniques. This raises the question: how well does its <a href="https://learn.microsoft.com/en-us/entra/identity/devices/protecting-tokens-microsoft-entra-id#defense-in-depth-strategy-against-token-theft">defense-in-depth strategy</a> actually hold up against this shift? We put it to the test.</p>