GoTokenTheft
GoTokenTheft is a Go-based utility used to steal Windows access tokens and potentially run commands with elevated privileges. Cisco Talos observed it in post-compromise activity by UAT-8837, a threat actor Talos assesses with medium confidence to be China-nexus, targeting critical infrastructure organizations in North America since at least 2025. In these intrusions, UAT-8837 gained initial access via exploitation of vulnerable servers or use of compromised credentials, including activity associated with Sitecore CVE-2025-53690, then conducted hands-on-keyboard reconnaissance, disabled RDP RestrictedAdmin, and deployed GoTokenTheft alongside tools such as Rubeus, Certipy, SharpHound, Impacket, GoExec, Earthworm, and DWAgent to harvest credentials, abuse Kerberos, enumerate Active Directory, execute remote commands, and maintain access. One cited description states the utility was written in GoLang and deployed as C:\Users<user>\Desktop\go.exe. The content does not provide standalone hashes for GoTokenTheft, but it explicitly identifies token theft and privilege escalation-related use in UAT-8837 operations.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Some of the notable tools include - GoTokenTheft, to steal access tokens
Techniques & procedures
2 distinct techniques documented for this family, organized by ATT&CK tactic.
Privilege Escalation
1 techniqueStealth
1 techniqueCredential Access
1 techniqueSome of the notable tools include - GoTokenTheft, to steal access tokens
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A tool used to steal access tokens in Windows/AD environments as part of credential access operations.
A tool used to steal access tokens from compromised environments.
Go-based utility used to steal access tokens to enable elevated/impersonated command execution.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.