# T1606.002 SAML Tokens > As of 2026-10-15, T1606.002 (SAML Tokens) appears in 10 tracked threats, first reported 2026-04-20 and most recently 2026-10-15, with linked actors including Kali365 PhaaS operators, Storm-2603; it most often appears alongside T1550.001 (Application Access Token). - **Tracked threats:** 10 (8 critical, 2 high) - **First seen:** 2026-04-20 - **Last seen:** 2026-10-15 - **Threat actors:** 2 - **Detection rules:** 34 (counts only; Blue tier and above) ## Key facts - **ID:** T1606.002 - **Framework:** MITRE ATT&CK - **Tactics:** Credential Access - **Matrix:** Enterprise - **Parent:** T1606 - **Data as of:** 2026-10-15 - **MITRE:** https://attack.mitre.org/techniques/T1606/002/ ## Activity timeline T1606.002 first appeared in tracked threats on 2026-04-20 and was most recently reported on 2026-10-15. The busiest month was 2026-08 with 3 reports, and 10 of the 10 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1606.002 SAML Tokens is catalogued by MITRE ATT&CK under the Credential Access tactic in the Enterprise matrix, as a sub-technique of [T1606 Forge Web Credentials](https://intel.threadlinqs.com/technique/T1606). Threadlinqs maps 10 of 2892 tracked threats (0.3%) to it; by severity that is 8 critical, 2 high. Threats that use T1606.002 most often also use [T1550.001 Application Access Token](https://intel.threadlinqs.com/technique/T1550.001) (8 threats), [T1190 Exploit Public-Facing Application](https://intel.threadlinqs.com/technique/T1190) (7 threats), [T1071.001 Web Protocols](https://intel.threadlinqs.com/technique/T1071.001) (6 threats), [T1528 Steal Application Access Token](https://intel.threadlinqs.com/technique/T1528) (6 threats), [T1059 Command and Scripting Interpreter](https://intel.threadlinqs.com/technique/T1059) (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 2 tracked threat actors appear in the threats that use T1606.002; the most frequent are [Kali365 PhaaS operators](https://intel.threadlinqs.com/actor/Kali365%20PhaaS%20operators) (1), [Storm-2603](https://intel.threadlinqs.com/actor/Storm-2603) (1). ## Mitigations MITRE ATT&CK lists 4 mitigations for T1606.002. - [M1015 Active Directory Configuration](https://attack.mitre.org/mitigations/M1015/) - [M1018 User Account Management](https://attack.mitre.org/mitigations/M1018/) - [M1026 Privileged Account Management](https://attack.mitre.org/mitigations/M1026/) - [M1047 Audit](https://attack.mitre.org/mitigations/M1047/) ## Data sources Telemetry that can reveal T1606.002, per MITRE ATT&CK. - Logon Session — Logon Session Creation, Logon Session Metadata - Process — Process Creation - User Account — User Account Authentication - Web Credential — Web Credential Creation, Web Credential Usage ## Threat actors using it - [Kali365 PhaaS operators](https://intel.threadlinqs.com/actor/Kali365%20PhaaS%20operators) — 1 - [Storm-2603](https://intel.threadlinqs.com/actor/Storm-2603) — 1 ## Tracked threats 10 tracked threats use T1606.002. - [Multiple Active Directory Federation Services (AD FS) Authentication Bypass and Spoofing Vulnerabilities…](https://intel.threadlinqs.com/threat/TL-2026-3584) — critical — 2026-10-15 - [Edge Infrastructure Under Siege: Tenable and SentinelOne Datasets Reveal Convergent Nation-State and…](https://intel.threadlinqs.com/threat/TL-2026-2153) — high — 2026-08-26 - [CVE-2026-69836: Unauthenticated Remote Code Execution in Microsoft Entra ID via Deserialization of Untrusted…](https://intel.threadlinqs.com/threat/TL-2026-2107) — critical — 2026-08-22 - [CVE-2026-19490 — Critical Authentication Bypass in Citrix NetScaler ADC and Gateway (CVSS 9.3) with…](https://intel.threadlinqs.com/threat/TL-2026-2080) — critical — 2026-08-20 - [July 2026 Patch Tuesday: Actively Exploited SharePoint RCE (CVE-2026-58644) and AD FS/SharePoint Zero-Days](https://intel.threadlinqs.com/threat/TL-2026-1437) — critical — 2026-07-17 - [Actively Exploited SharePoint Server Elevation of Privilege Flaw (CVE-2026-56164) Patched Alongside Critical…](https://intel.threadlinqs.com/threat/TL-2026-1364) — critical — 2026-07-15 - [CVE-2026-44748: XML Signature Wrapping in SAP NetWeaver AS ABAP SAML Authentication (CVSS 9.9)](https://intel.threadlinqs.com/threat/TL-2026-0762) — critical — 2026-06-10 - [Kali365 PhaaS — Telegram-Distributed Microsoft 365 Device-Code Phishing with OAuth Token Theft & MFA Bypass…](https://intel.threadlinqs.com/threat/TL-2026-0560) — high — 2026-05-22 - [Storm-2949 Cloud-Wide Breach — SSPR Abuse & Azure RBAC Lateral Movement to Mass Data Exfiltration](https://intel.threadlinqs.com/threat/TL-2026-0529) — critical — 2026-05-19 - [Context.ai OAuth Token Compromise: SaaS Integration-Layer Supply Chain Attack](https://intel.threadlinqs.com/threat/TL-2026-0398) — critical — 2026-04-20 ## Related CVEs CVEs referenced by the tracked threats that use T1606.002, most frequent first. - [CVE-2026-50522](https://intel.threadlinqs.com/cve/CVE-2026-50522) - [CVE-2026-55040](https://intel.threadlinqs.com/cve/CVE-2026-55040) - [CVE-2026-56164](https://intel.threadlinqs.com/cve/CVE-2026-56164) - [CVE-2026-58644](https://intel.threadlinqs.com/cve/CVE-2026-58644) - [CVE-2023-34124](https://intel.threadlinqs.com/cve/CVE-2023-34124) - [CVE-2023-34132](https://intel.threadlinqs.com/cve/CVE-2023-34132) - [CVE-2023-34133](https://intel.threadlinqs.com/cve/CVE-2023-34133) - [CVE-2023-42793](https://intel.threadlinqs.com/cve/CVE-2023-42793) - [CVE-2024-24919](https://intel.threadlinqs.com/cve/CVE-2024-24919) - [CVE-2024-3400](https://intel.threadlinqs.com/cve/CVE-2024-3400) - [CVE-2024-47575](https://intel.threadlinqs.com/cve/CVE-2024-47575) - [CVE-2024-8190](https://intel.threadlinqs.com/cve/CVE-2024-8190) - [CVE-2024-8963](https://intel.threadlinqs.com/cve/CVE-2024-8963) - [CVE-2025-59718](https://intel.threadlinqs.com/cve/CVE-2025-59718) - [CVE-2025-59719](https://intel.threadlinqs.com/cve/CVE-2025-59719) - [CVE-2026-15409](https://intel.threadlinqs.com/cve/CVE-2026-15409) - [CVE-2026-15410](https://intel.threadlinqs.com/cve/CVE-2026-15410) - [CVE-2026-19489](https://intel.threadlinqs.com/cve/CVE-2026-19489) - [CVE-2026-19490](https://intel.threadlinqs.com/cve/CVE-2026-19490) - [CVE-2026-24858](https://intel.threadlinqs.com/cve/CVE-2026-24858) - [CVE-2026-32201](https://intel.threadlinqs.com/cve/CVE-2026-32201) - [CVE-2026-44748](https://intel.threadlinqs.com/cve/CVE-2026-44748) - [CVE-2026-45659](https://intel.threadlinqs.com/cve/CVE-2026-45659) - [CVE-2026-50661](https://intel.threadlinqs.com/cve/CVE-2026-50661) - [CVE-2026-55008](https://intel.threadlinqs.com/cve/CVE-2026-55008) - [CVE-2026-56155](https://intel.threadlinqs.com/cve/CVE-2026-56155) - [CVE-2026-57092](https://intel.threadlinqs.com/cve/CVE-2026-57092) - [CVE-2026-69836](https://intel.threadlinqs.com/cve/CVE-2026-69836) ## Detection coverage Threadlinqs maintains 34 detection rules mapped to T1606.002 (SPL 11, KQL 8, Sigma 15). Rule content is available to Blue tier accounts and above; this page shows counts only. 34 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1606 Forge Web Credentials](https://intel.threadlinqs.com/technique/T1606) — 93 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1606.002 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)