AML.T0091.000 sub-technique demonstrated

Application Access Token

Sub-technique of AML.T0091 — Use Alternate Authentication Material

Lateral Movement ATT&CK T1550.001 View on ATLAS ↗

Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials.

Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used to access resources in cloud, container-based applications, software-as-a-service (SaaS), and AI-as-a-service(AIaaS). They are commonly used for AI services such as chatbots, LLMs, and predictive inference APIs.

> curated attacks (1)

Research high 2025-01-01

AIKatz: Stealing Auth Tokens from LLM Desktop Applications

Researchers extracted authentication tokens from the memory of LLM desktop apps (Claude, ChatGPT, Copilot). With a stolen token, an attacker impersonates the victim to the LLM backend — lateral movement into the user's AI account.