ETS
Home
Created by Claudiu Tabac - © 2026
This material is open for educational and research use. Commercial use without explicit permission from the author is not allowed.
BP-048 Machine Token Theft
What This Breach Pattern Is
This breach pattern occurs when attackers steal machine-issued access tokens used by automated systems and workloads. Even though these tokens are often short-lived (5–60 minutes), attackers exploit the window to authenticate as machine identities, impersonate critical services, and escalate privileges rapidly.
Machine token theft represents one of the most silent yet powerful forms of identity abuse. Once attackers possess these tokens, they effectively "become the application" — bypassing traditional security controls and human authentication barriers entirely.
Target Token Types
  • Workload identity tokens (Azure, AWS IAM, GCP)
  • Managed identity tokens
  • OAuth bearer tokens
  • Kubernetes service account tokens
  • Container runtime tokens
  • Automation agent tokens
Authenticate
Impersonate workloads and services using stolen credentials
Escalate
Chain token exchanges to gain elevated privileges
Pivot
Access cloud APIs and move laterally across resources
Extract
Retrieve secrets and perform privileged actions
Attacker Objectives & Attack Surface
Impersonation
Assume identity of critical workloads and bypass MFA requirements
API Access
Control cloud management APIs, storage accounts, and vault secrets
Lateral Movement
Propagate through container and serverless ecosystems undetected
Exfiltration
Extract logs, secrets, datasets, and request extended access tokens
Critical Misconfigurations That Enable This Pattern
MC-511
Overprivileged Managed Identities
Machine identities granted excessive permissions beyond operational needs
MC-512
Token Accessible in Container Filesystem
Credentials exposed in readable locations within container environments
MC-513
Lack of Network Isolation
Workloads operating without proper network segmentation controls
MC-514
No Token Binding
Missing identity constraints allowing token reuse across contexts
Detection, Threat Mapping & Navigation
DL-056 — Suspicious Machine Identity Auth
Machine identity tokens used from unexpected hosts or geographic locations
DL-024 — Unusual Cloud API Calls
Workload performing human-level admin or directory actions beyond normal scope
DL-041 — Abnormal Token Issuance
Frequent or unusual token requests from machine identities indicating compromise
DL-088 — Unauthorized Role Assignment
Indicators of privilege escalation or lateral pivoting via machine identity
Attack Chain Stages
Stage 3 — Credential Acquisition
Stage 4 — Authentication Abuse
Stage 5 — Privilege Escalation
Stage 6 — Token Tampering
Stage 7 — Lateral Movement
Known Threat Actors
ICTAM-001
APT29 — Uses machine tokens to escalate into cloud management planes
ICTAM-014
Cloud-Native Groups — Specialize in container token theft operations
ICTAM-020
RaaS Affiliates — Automate token extraction in compromised VMs
ICTAM-040
Supply-Chain Attackers — Pivot through machine identity trust chains

Related Executive Storylines
ETS-003: Imagine attackers stealing your machine identities, then rapidly escalating their access to seize full control of your cloud infrastructure.
ETS-010: Or consider how a single exposed SaaS integration could unravel into a catastrophic, multi-system breach across your entire digital ecosystem.
About
Created by Claudiu Tabac — © 2026
This framework is open for educational and research use. Commercial use without explicit permission from the author is not allowed.