Bluekit BitM Session Token Reuse from Two IPs with Post-Auth Sensitive Actions

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•4

Detects instances where a single authentication correlation ID is associated with multiple distinct IP addresses within a 10-minute window, followed by high-risk administrative or data-access actions within 30 minutes. This behavior is indicative of session hijacking or post-authentication account compromise, where an adversary uses stolen session tokens to perform unauthorized activities.