PRT-backed sign-in persists after password reset (ARToken)

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•1

Detects sign-in activity using pre-existing durable session tokens (e.g., PRT, broker-based tokens) that occur shortly after a password reset, suggesting that the adversary has maintained persistent access despite the credential change.