Activity timeline
T1606.002 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-08 with 3 reports, and 10 of the 10 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1606.002 SAML Tokens is catalogued by MITRE ATT&CK under the Credential Access tactic in the Enterprise matrix, as a sub-technique of T1606 Forge Web Credentials. Threadlinqs maps 10 of 2892 tracked threats (0.3%) to it; by severity that is 8 critical, 2 high.
Threats that use T1606.002 most often also use T1550.001 Application Access Token (8 threats), T1190 Exploit Public-Facing Application (7 threats), T1071.001 Web Protocols (6 threats), T1528 Steal Application Access Token (6 threats), T1059 Command and Scripting Interpreter (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
2 tracked threat actors appear in the threats that use T1606.002; the most frequent are Kali365 PhaaS operators (1), Storm-2603 (1).
Mitigations
MITRE ATT&CK lists 4 mitigations for T1606.002.
Data sources
Telemetry that can reveal T1606.002, per MITRE ATT&CK.
- Logon Session — Logon Session Creation, Logon Session Metadata
- Process — Process Creation
- User Account — User Account Authentication
- Web Credential — Web Credential Creation, Web Credential Usage
Threat actors using it
Tracked threats
10 tracked threats use T1606.002.
- Multiple Active Directory Federation Services (AD FS) Authentication Bypass and Spoofing Vulnerabilities…critical
- Edge Infrastructure Under Siege: Tenable and SentinelOne Datasets Reveal Convergent Nation-State and…high
- CVE-2026-69836: Unauthenticated Remote Code Execution in Microsoft Entra ID via Deserialization of Untrusted…critical
- CVE-2026-19490 — Critical Authentication Bypass in Citrix NetScaler ADC and Gateway (CVSS 9.3) with…critical
- July 2026 Patch Tuesday: Actively Exploited SharePoint RCE (CVE-2026-58644) and AD FS/SharePoint Zero-Dayscritical
- Actively Exploited SharePoint Server Elevation of Privilege Flaw (CVE-2026-56164) Patched Alongside Critical…critical
- CVE-2026-44748: XML Signature Wrapping in SAP NetWeaver AS ABAP SAML Authentication (CVSS 9.9)critical
- Kali365 PhaaS — Telegram-Distributed Microsoft 365 Device-Code Phishing with OAuth Token Theft & MFA Bypass…high
- Storm-2949 Cloud-Wide Breach — SSPR Abuse & Azure RBAC Lateral Movement to Mass Data Exfiltrationcritical
- Context.ai OAuth Token Compromise: SaaS Integration-Layer Supply Chain Attackcritical
Detection coverage
Threadlinqs maintains 34 detection rules mapped to T1606.002 (SPL 11, KQL 8, Sigma 15). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1606 Forge Web Credentials — 93 tracked threats at the technique level.