Full Report
A practical playbook for investigating GitHub token compromise, drawn from Wiz CIRT's response to a coordinated multi-organization campaign.
Analysis Summary
# Incident Report: Multi-Organization GitHub PAT Compromise Campaign
## Executive Summary
A coordinated campaign targeted multiple organizations by leveraging compromised GitHub Personal Access Tokens (PATs) to conduct automated, large-scale repository reconnaissance and exfiltration. The attacker utilized a highly parallelized infrastructure to clone thousands of private repositories, likely seeking hardcoded secrets for follow-on exploitation. The incident highlights the critical risk of PAT mismanagement and the difficulty of visibility into "Classic" PATs.
## Incident Details
- **Discovery Date:** June 1, 2026
- **Incident Date:** Mid-May to early June 2026
- **Affected Organization:** Multiple organizations (unnamed)
- **Sector:** Cross-sector (including technology and software development)
- **Geography:** Global; attacker infrastructure located in Canada (AWS `ca-central-1`)
## Timeline of Events
### Initial Access
- **Date/Time:** Mid-May 2026
- **Vector:** Compromised Personal Access Tokens (PATs)
- **Details:** Attackers obtained valid PATs belonging to employees. While the specific theft method (phishing, malware, or credential stuffing) was not confirmed, the tokens were used to validate access before mass exfiltration.
### Lateral Movement
- **Technique:** The attacker moved from initial token validation to broad repository discovery within the GitHub organizations that the compromised users had permissions to access.
### Data Exfiltration/Impact
- **Date/Time:** June 1, 2026 (09:14 – 14:55 UTC)
- **Details:** Mass cloning of private repositories. In some cases, thousands of repositories were cloned per organization using automated scripts.
### Detection & Response
- **Discovery:** Detection occurred via GitHub Audit Logs, which showed a massive spike in `git.clone` activity.
- **Response Actions:** Revocation of compromised PATs, removal of affected users from organizations, and forensic analysis of logs to determine the "blast radius" of exposed secrets.
## Attack Methodology
- **Initial Access:** Valid GitHub Personal Access Tokens (PATs).
- **Persistence:** Not applicable; relied on the validity of the stolen PATs.
- **Privilege Escalation:** Not reported; access was limited to the permissions of the compromised user.
- **Defense Evasion:** Use of 102 different AWS IP addresses to distribute requests.
- **Credential Access:** Likely obtained via endpoint compromise or previous data breaches.
- **Discovery:** Automated repository reconnaissance.
- **Lateral Movement:** Exploration of all repositories accessible by the compromised token.
- **Collection:** Mass cloning of source code.
- **Exfiltration:** Large-scale `git clone` operations.
- **Impact:** Potential for follow-on attacks using secrets (API keys, cloud credentials) found in the source code.
## Impact Assessment
- **Financial:** High potential cost related to incident response and credential rotation.
- **Data Breach:** Massive theft of proprietary source code and any secrets contained within.
- **Operational:** Disruption caused by emergency credential rotation and user lockouts.
- **Reputational:** Risk of intellectual property theft and exposure of customer-facing secrets.
## Indicators of Compromise
- **Network Indicators:** 102 AWS IP addresses in `ca-central-1` (e.g., `35[.]183[.]x[.]x`)
- **File Indicators:** Use of User-Agent `git/2.43.0`.
- **Behavioral Indicators:** Sudden spikes in `git.clone` activity from non-corporate IP ranges; highly parallelized API requests.
## Response Actions
- **Containment:** Revocation of Fine-grained PATs; removal of SSO authorization for Classic PATs.
- **Eradication:** Temporary removal of affected users from the GitHub organization to prevent re-entry.
- **Recovery:** Full audit of all secrets (AWS keys, etc.) that existed in the cloned repositories and mandatory rotation of those secrets.
## Lessons Learned
- **Visibility Gaps:** Organization owners have limited visibility into "Classic" PATs, making it difficult to detect or revoke them centrally unless SAML SSO is enforced.
- **Automation is Key:** Attackers are using highly automated, parallelized tools, requiring defenders to have automated alerting for audit log anomalies.
- **The Danger of Hardcoded Secrets:** Source code exfiltration is often a precursor to a larger cloud breach if credentials are not properly managed.
## Recommendations
- **Transition to Fine-grained PATs:** Move away from Classic PATs to gain better control and visibility.
- **Enforce SAML SSO:** Require SAML for GitHub access to ensure that offboarding an employee or revoking a session terminates PAT access.
- **Implement Secret Scanning:** Use tools to detect and block secrets from being pushed to repositories in the first place.
- **Monitor Audit Logs:** Set up alerts for high volumes of `git.clone` or `repository.download` events, especially from cloud provider IP ranges.