Sadly the game wasn't sending any data over HTTP or HTTPS so I decided to switch routes and try finding anywhere you can modify/view information about your in-game account online. Some interesting findings were that you could use any arbitrary URI handler, but with the advances in web browsers beyond redirecting and rendering "javascript" and "data", there isn't any simple trick to to steal the token in any modern browser outside of MITMing HTTP requests. Redirect the victim to our poisoned "www.rocketleague.com" URL, ending in "#jwt=theirSecret" Use our poisoned URL to redirect the user to our domain and therefore forward the "jwt=theirSecret" Login to their account using the JWT in the URL as it hasn't been consumed yet