Identity Provider (IdP) token theft is a growing tactic in todays phishing attacks. Token theft can happen in many ways but a common real world method is token theft through a phishing email/site. Here I will map out the attack chain that I've seen and become familiar