OAuth Token & Session Cookie Harvesting from AppData/.config Directories

Ankit Mehta@Secvyn

•updated Jun 27, 2026•0•0•1

Detects unauthorized access, creation, or modification of sensitive credential and token files (e.g., OAuth tokens, AWS credentials, gcloud tokens) in common user directories like AppData or .config by processes other than established browsers or legitimate cloud CLI tools. This behavior is indicative of credential theft or SaaS pivot attacks.