OAuth token theft is the stealing of an access token or refresh token so an attacker can act as an already authenticated user. Unlike a password, a stolen token can let an intruder skip the login step and reuse the victim’s session until the token expires, is revoked, or is otherwise constrained. This makes tokens highly valuable in modern identity attacks, especially when they have long lifetimes or broad scopes.
In real intrusions, attackers may capture tokens from a compromised browser, malicious proxy, memory scraping malware, insecure logs, or phishing flows that trick a user into authorizing a hostile app. Defenders reduce the impact with short-lived access tokens, refresh-token rotation, sender-constrained tokens, strong revocation, and secure token storage. Monitoring for unusual token use, such as new devices, impossible travel, or suspicious API patterns, can also expose replay before the attacker expands access.