Mac PRT Cookie Theft & Entra ID Persistence
Demonstrates techniques for stealing Microsoft Primary Refresh Tokens (PRT) and cookies on macOS endpoints to achieve persistent access to Entra ID cloud resources.
Summary
Primary Refresh Tokens in macOS Enterprise Environments
Enterprises deploying Microsoft Entra ID with macOS endpoints rely on Primary Refresh Tokens (PRTs) stored inside system keychains and SSO extensions to provide seamless single sign-on across corporate SaaS apps.
Extracting PRT Cookies and SSO Secrets on macOS
Shang-De Jiang, Dong-Yi Ye, and Tung-lin Lee demonstrate how attackers with local user access can bypass macOS Keychain protections and extract active PRT session cookies from enterprise browser caches and Microsoft SSO plug-ins.
Persistent Cloud Access and Bypassing MFA
Replaying extracted PRT cookies allows adversaries to impersonate users across Azure, Office 365, and corporate cloud resources without triggering multi-factor authentication (MFA) or device compliance checks.
Defending Enterprise macOS Identity Endpoints
Hardening macOS identity infrastructure requires enforcing strict Keychain access controls, utilizing Secure Enclave hardware PRT binding, and deploying continuous conditional access evaluation in Entra ID.
Related talks
Main Stage·43 min
A Hernando · B Martinez
Uncovers overlooked legacy Windows execution paths and registry mechanisms to establish stealthy persistence that evades modern EDR detection.
Main Stage·42 min
Ceri Coburn · Dirk-jan Mollema
Methods and tooling to extract Windows Hello biometric secrets and hijack Primary Refresh Tokens for persistent identity access.
Main Stage·20 min
Wojciech Reguła
Wojciech Reguła demonstrates hijacking Electron application configurations on macOS to inherit high-privilege TCC permissions without zero-days.