T1098.A006

aws-samples.github.io • April 28, 2026

A prerequisite for this technique is that a threat actor has already gained initial access into an environment and control of a valid Amazon Cognito refresh token, typically through credential theft, elevated permissions, or compromise of client-side storage. With access to a valid Amazon Cognito refresh token, threat actors can maintain persistent access to an application by continuously obtaining new ID and access tokens without re-entering credentials. Amazon Cognito refresh tokens are long-lived credentials (default 30 days, configurable from 60 minutes to 10 years) that allow users to obtain new authentication tokens. When a threat actor possesses a valid refresh token, they can call the cognito-idp:GetTokensFromRefreshToken API to generate fresh ID and access tokens, effectively maintaining unauthorized access to the application and its resources even after the original access tokens have expired. Unlike short-lived access tokens that expire within minutes or hours, refresh tokens provide an extended window of opportunity for threat actors to maintain persistence. This is particularly concerning in environments where refresh token rotation is not enabled, as the same refresh token can be reused indefinitely within its validity period.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Threat Actors Exploit AWS Cognito Refresh Tokens for Persistent Access In April 2026, AWS reported that threat actors are exploiting Amazon Cognito refresh tokens to maintain unauthorized access to applications. These tokens, which can be valid for up to 10 years, allow attackers to generate new access tokens without re-authenticating. The initial access is typically gained through credential theft or compromised client-side storage. This method enables attackers to remain undetected while continuing to access resources even after the original access tokens expire. The AWS Cyber Incident Response Team (CIRT) noted that environments without refresh token rotation are particularly vulnerable, as the same token can be reused indefinitely. Additionally, threat actors have been observed deregistering Amazon Machine Images (AMIs) to hinder recovery efforts. The updates to the Threat Technique Catalog (TTC) include new methods for detecting these activities and recommendations for mitigation. 2 sources 69

T1098.A006

The full story

Extracted Entities

CWE Weaknesses (1)

Platforms (1)