---
name: detecting-oauth-token-theft
description: >
  Detect OAuth access token theft and misuse by analyzing sign-in logs for
  impossible travel, new device patterns, token replay from unusual IPs,
  and anomalous scope requests via Microsoft Graph and Okta APIs.
domain: cybersecurity
subdomain: identity-security
tags: [oauth, token-theft, identity-attacks, impossible-travel]
version: "1.0"
author: mahipal
license: Apache-2.0
---

# Detecting OAuth Token Theft

Analyze OAuth sign-in telemetry for indicators of token theft including
impossible travel, device fingerprint changes, and token replay attacks.