Loading story…
Security researchers detailed how attackers abuse Windows access tokens to impersonate users, elevate privileges, and move laterally across enterprise environments. The technique relies on the way Windows ties logon sessions, privileges, and cached credentials to access tokens, allowing an attacker with sufficient local rights to duplicate or impersonate another process token and launch a new process under that security context. One proof-of-concept shows a local administrator enabling SeDebugPrivilege, opening a privileged process such as winlogon.exe, duplicating its token, and using CreateProcessWithTokenW to spawn a process as SYSTEM.
Additional analysis shows token manipulation extends beyond local privilege escalation into stealthier authentication abuse, including NETONLY logons, Pass-the-Hash, Pass-the-Ticket, and Overpass-the-Hash. Researchers said attackers can abuse Windows APIs such as LogonUserW, CreateProcessWithLogonW, DuplicateTokenEx, SetThreadToken, ImpersonateLoggedOnUser, and LsaCallAuthenticationPackage to create new logon sessions or alter authentication behavior without changing the visible local user context. Defenders were advised to watch for artifacts such as Event ID 4624 with LogonType 9 and to account for detection gaps where Kerberos ticket operations may occur without direct LSASS process access.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
A second Cocomelonc tutorial demonstrated an alternative token theft method using UpdateProcThreadAttribute and PROC_THREAD_ATTRIBUTE_PARENT_PROCESS to spawn a child process that inherits the chosen parent process token, such as from winlogon.exe.
A Cocomelonc tutorial published a C++ proof of concept showing how to enable SeDebugPrivilege, open another process token, duplicate it with DuplicateTokenEx, and launch a new process with CreateProcessWithTokenW, using a privileged process such as winlogon.exe to obtain SYSTEM.
Microsoft published documentation for Win32 privilege constants, including privileges relevant to token manipulation scenarios such as SeDebugPrivilege and SeImpersonatePrivilege.
Elastic Security Labs published a technical analysis of how attackers abuse Windows access token manipulation for lateral movement and Active Directory compromise, covering techniques such as NETONLY, Pass-the-Ticket, Pass-the-Hash, and Overpass-the-Hash.
A public GitHub repository published a C++ Windows utility that enables SeDebugPrivilege and SeImpersonatePrivilege, impersonates SYSTEM via winlogon.exe, starts the TrustedInstaller service if needed, and launches a process such as cmd.exe with a duplicated TrustedInstaller token. The visible commit is labeled "Initial Commit."
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
6 references tracked. Mallory keeps watching after this page renders.
cocomelonc.github.io
Open sourcecocomelonc.github.io
Open sourcelearn.microsoft.com
Open sourcelearn.microsoft.com
Open sourceelastic.co
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Recent research shows attackers continue to rely on legitimate Windows administration features for lateral movement, with WMI, Scheduled Tasks, SMB admin shares, RDP, PsExec, and anomalous Kerberos activity remaining common across enterprise intrusions. VMware telemetry covering 489 multi-host intrusions found **44.7%** included lateral movement, typically across fewer than 20 hosts and using short, focused paths, while Gigamon detailed how remote WMI execution and Scheduled Tasks often blend into normal administration through DCE/RPC operations such as `ExecMethod`, `SchRpcRegisterTask`, `SchRpcRun`, and `SchRpcDelete`, frequently paired with SMB payload transfer and shared outbound command-and-control destinations. Newer Windows tradecraft is also exploiting **cross-session activation** and service manipulation to execute code under another user’s interactive session or persist more stealthily after compromise. Purple Team research described COM/DCOM abuse using `RunAs=Interactive User`, remote registry changes, and CLSID hijacking—including abuse of **SpeechRuntime.exe** via the CLSID `{655D9BF9-3876-43D0-B6E8-C83C1224154C}`—as well as tooling such as COMThanasia, PermissionHunter, SessionHop, and SpeechRuntimeMove; separate analysis showed attackers can evade simpler detections by abusing Windows Service recovery functions and registry-backed service creation. Across these techniques, defenders are urged to correlate process creation, registry access, service state changes, authentication context, and network telemetry, with attention to Windows events including **4688**, **4663**, **4657**, **7036**, and **7040**.
Aug 15, 2026
Security researchers published multiple technical demonstrations showing how Windows **User Account Control (UAC)** can still be bypassed through complex elevation paths, including a method described by James Forshaw and a later public proof of concept, **`SspiUacBypass`**, that uses **SSPI Datagram Contexts** to obtain elevated execution. The GitHub project exposes C++ research code for the technique and links it to broader work on abusing Windows elevation mechanisms, underscoring that UAC bypass tradecraft remains publicly documented and reproducible for attackers as well as defenders. A separate review of Microsoft’s upcoming Windows 11 **Administrator Protection** feature says the redesign reduces exposure to common split-token and COM auto-elevation abuse by introducing per-user **"Shadow Admin"** accounts, but does not fully eliminate legacy elevation weaknesses. The analysis says some bypass avenues and risky behaviors still persist, including issues tied to **`LocalAccountTokenFilterPolicy`**, **`RunOnce`** auto-elevation behavior, and certain **UIAccess** interactions, leaving enterprises with a transitional model where newer protections coexist with older high-integrity token paths.
Jul 24, 2026
Researchers detailed how Microsoft nested app authentication (NAA), also called **BroCI**, can let an attacker who already holds a valid refresh token from a broker-capable Microsoft application exchange it for tokens to other apps and resources. The technique was shown against Azure and Entra ID workflows to retrieve Conditional Access Policy data, activate Privileged Identity Management roles, access Azure Key Vault secrets, and enumerate Intune devices by brokering requests through administrator portals. The write-up emphasized that MFA claims present in the original broker token can persist into downstream requests, potentially satisfying Conditional Access checks, and clarified that the method relies on **refresh tokens**, not access tokens. A separate offensive analysis showed that **VS Code Dev Tunnels** can be abused for remote access by using authenticated GitHub or Azure/Entra ID tokens to enumerate tunnels, obtain connect-scoped JWTs, establish WebSocket relay sessions, and invoke MsgPack-based RPC methods for command execution and file operations on tunnel hosts. The author said credentials stored by VS Code can still be recovered by same-user processes despite Electron `safeStorage`, and released a Rust proof-of-concept called **Ouroboros** to interact with existing tunnels. Together, the research highlights how token theft, device-code phishing, and Microsoft token pivoting techniques such as **FOCI/BroCI** can extend access across cloud administration surfaces and developer remote-access infrastructure.
Jul 24, 2026