EvilTokens: new-device token refresh persisting after password reset

Arnold Chan@slaz

•updated Sep 23, 2026•1•0•6

Detects potential abuse of stolen OAuth session tokens, where refresh tokens are used to authenticate after a user has performed a password reset. This rule identifies accounts that continue to sign in from previously unseen devices or IP addresses within 24 hours post-password reset, a technique consistent with session persistence mechanisms used by adversary tools and platforms like EvilTokens.