Primary Refresh Tokens Are Becoming Hackers' Theft Target of Choice

If you haven't been paying attention closely enough, a new type of access control token, like a super browser token on steroids, is becoming hackers' theft target of choice.

If you haven’t been paying attention closely enough, a new type of access control token, like a super browser token on steroids, is becoming hackers' theft target of choice. It is known as a primary refresh token. In the Microsoft ecosystem, it’s the king of tokens.

Most access control tokens give users access to a single application, service, or site. If I use my browser to successfully login to an app/service/site, my browser will get a browser “cookie,” which is just a text file usually containing a randomly generated session ID, that gives that browser continued access to that app/service/site without having to re-logon again for a preset number of days or weeks.

My browser gets a separate access control token cookie for each app/service/site I successfully log on to. Most of us, if we go to our cookie directory, will see hundreds of cookies.

Hackers and their malware creations love to steal our browser cookies because they act as “bearer tokens.” Whoever has them is essentially seen as us to that app/service/site. Here is a great demo created by the late, great Kevin Mitnick (our former Chief Hacking Officer and owner) on a cookie being stolen and reused.

Hackers love cookie theft because it can work whether you are using a password, multi-factor authentication (MFA), biometrics, or some other super-duper authentication method. If the hacker gets your access control token cookie, it’s game over…for you and the involved app/site/service.

Hackers have been stealing browser cookies for decades, and just now some organizations, like Google, are trying to come up with ways to better protect them, such as device-bound cookies. Still, importantly, none of the existing cookie protections are all that great. Most can still be easily circumvented by hackers. Your cookies are still very valuable to any hacker who has them.

Most cybersecurity defenders have understood our cookie problem. What most defenders are not aware of is Microsoft’s new primary refresh tokens, which are sort of like an access control token cookie on steroids.

What is a Primary Refresh Token?In short, it’s a Microsoft-only invention used in Microsoft ecosystems (AFAIK) that allows a user or device to access multiple apps/services/sites at once (i.e., Single-Sign-On) and usually for extended periods of time. They’ve been around since at least 2020, but are gaining in popularity.

Microsoft describes them this way:

“A Primary Refresh Token (PRT) is a key artifact of Microsoft Entra [formerly Microsoft Azure AD] authentication on Windows 10 or newer, Windows Server 2016 and later versions, iOS, and Android devices. It's a JSON Web Token (JWT) specially issued to Microsoft first party token brokers to enable single sign-on (SSO) across the applications used on those devices.

In this article, provide details on how a PRT is issued, used, and protected on Windows 10 or newer devices. We recommend using the latest versions of Windows 10, Windows 11 and Windows Server 2019+ to get the best SSO experience.”

When you logon to a Microsoft ecosystem, especially using a device officially “registered” with Microsoft Entra, a primary refresh token could/will be issued to your user for a particular device. It contains your device ID and an encrypted session symmetric key.

When you log in to the Microsoft ecosystem (e.g., Microsoft Entra, Microsoft O365, etc.), your Microsoft Windows 10/Microsoft Windows Server 2016 or later device will communicate with the Windows Cloud Authentication Provider. The Microsoft Entra plug-in will validate your credentials (e.g., password, MFA, Windows Hello, etc.) and return a primary refresh token and the included session key.

Windows will encrypt the session key with the Trusted Platform Module (TPM) chip encryption key (if available) and then store it locally using Windows Local Security Authority Subsystem Service (LSASS), where Microsoft stores and processes a lot of authentication info.

You can see if you and your device have a primary refresh token is present on a device running the following command in a command prompt:

dsregcmd /status and then ENTER.

Find the "SSO state" section and look for the "AzureAdPrt" value. It will be set to "YES" if you have a primary refresh token or "NO" if you don’t. The session key is the “bearer token.” There is currently no way to see “inside” a primary refresh token the way you can a browser cookie. You could be issued multiple primary refresh tokens, one for each user work account registered to the device.

An issued primary refresh token is good for two weeks (14 days) and continuously renewed every 4 hours as long as the related user is active on