Beyond MFA: A Defender's Guide to Token Theft and AiTM
Source: YouTube · SANS Cloud Security · published Sep 29, 2026 · 1:00:28
MFA alone no longer stops modern identity attacks like token theft and device code phishing—the "Captive Crunch" hotel Wi-Fi campaign shows why organizations need phishing-resistant authentication and token protections 0:06.
Key Takeaways:
• Midnight Blizzard compromised hotel/conference captive portals to deliver malware, phish tokens, or run device code phishing on public Wi-Fi users 2:04
• MFA protects only sign-in; after login, issued tokens/cookies can be stolen—access tokens can't be revoked and refresh tokens last 90 rolling days 7:42
• AiTM phishing via reverse proxies (Evilginx, Tycoon 2FA) captures credentials, MFA approvals, and tokens because classic MFA doesn't validate origin 21:32
• Phishing-resistant = origin-bound private keys: FIDO2/passkeys, Authenticator passkey mode, Windows Hello for Business; passwordless ≠ phishing-resistant 29:41
• Device code phishing (e.g., Storm-2372 via Teams invites) grants immediate valid tokens—restrict this flow 47:53
• Mitigations: token protection binds tokens to devices (limited apps, no browsers yet); CAE rejects stolen access tokens near-instantly 52:40
Audit device code logins, require phishing-resistant strengths for admins/tier-zero identities, and pilot token protection while confirming CAE is active 58:59.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Identity & Access Management. Commonly maps to: Identity and Access Management (IAM), Security Architecture and Engineering. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Right. Hey, welcome everyone. Thanks for joining this webcast on um you know uh how we can move beyond multiffactor authentication, how it's no longer sufficient today uh to combat some of the modern attacks that we see against identities um including you know token theft adversary in the middle and a few other things that we'd like to cover today. Um my name is Maxim Dir. Um I am a principal instructor at science. I've been teaching for the last eight years and I have recently authored a new course which is the SAK 559 the cloud and hybrid identity security. Some of the topics that we're actually covering today are covered in this course a lot more in detail. Um and so if you're interested in uh in this spec these specific topics um I hope to see you at one of the runs of this class. Um i…