A GitHub token from March let an attacker get 472 of 638 repositories

Exaforce, a firm that makes detection tools, says that attackers get data in 15 minutes or less. In one incident, a token from a GitHub Desktop install in March was used on June 19. It pulled 76 repositories in about 15 seconds. Exaforce flagged it in five minutes. A person had to give approval, and the attacker got data from 472 of 638 repositories.

How it works

Exaforce describes these attack patterns:

• Stolen developer tokens: GitHub does not monitor how a token is used.
• Fake Claude Code install commands in shared chats install a macOS stealer.
• Help desk callers pose as IT staff and use a fake sign-in page.

They make a person agree to an MFA check. MFA is a sign-in check with 2 steps.

The numbers

The token stayed in the Mac keychain for 95 days. A keychain keeps passwords. In one vishing incident (a fake contact by phone), the attacker got 140,000 files and asked for a ransom.

What is not known

All figures come from incidents that Exaforce saw. No other group confirmed them. The report does not give the rate of incorrect automatic responses.

Insight: Attackers aim at tokens that no platform monitors

The GhostAction attack tried to get 3,174 secrets from public repositories. The Aoki malware gets tokens of Claude, Codex and Cursor. Here, a GitHub token stayed 95 days, and GitHub had no detection for its use. This is possibly a race for long-lived tokens, and the platforms give the monitor task to the buyer. Leaders must do this task.