Exaforce says GitHub token theft and vishing drain data in minutes
Original title: Machine speed attacks require machine speed detection and response
A dormant OAuth token pulled 472 of 638 repositories; ClickFix and help-desk vishing followed the same pattern.
Exaforce describes three patterns in which data left environments within minutes of access. Poisoned npm packages and infostealers steal GitHub tokens that GitHub does not monitor for misuse; one dormant Mac keychain token later downloaded hundreds of repositories through European residential proxies. Separate cases used a fake Claude Code install command to run a macOS stealer and help-desk vishing, often matching Scattered Spider scripts, to register MFA devices and hijack sessions. The vendor says identity alerts treated approved MFA as remediation.
Unconfirmed: Timelines, volumes, and detection claims are Exaforce's account; affected customers are not named.
- An OAuth token unused for 95 days pulled 76 repositories in about 15 seconds.
- Attackers later exfiltrated 472 of 638 repositories before the token was contained.
- GitHub OAuth tokens prefixed gho_ do not expire and may be invisible on the SSO page.
- A shared Claude chat served a one-line command that loaded a macOS stealer.
- In one vishing case, 140,000 files were taken and a ransom was demanded.
Impact: GitHub repo exfiltration, stolen sessions, and credential theft
- 1.Revoke long-lived GitHub OAuth tokens, including gho_ tokens not shown on the SSO page.
- 2.Use endpoint detection for one-line AI tool install commands from shared chats.
- 3.Review all tokens and credentials minted by users targeted in vishing.
- ATT&CK
- T1528 Steal Application Access TokenT1555.001 KeychainT1566.004 Spearphishing VoiceT1557 Adversary-in-the-MiddleT1621 Multi-Factor Authentication Request Generation
- Products
- Claude CodenpmGitHub Desktop
- Threat actors
- Scattered Spider
- Malware
- Shai-Hulud
- Organizations
- Exaforce
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | add-passkey.com | mpany's name in the URL, such as the passkey-themed contoso.add-passkey[.]com in Microsoft's September write-up . The page either relay |
| domain | oskeysetup.com | h a device-code sign-in. One kit we took apar t , hosted on oskeysetup[.]com, was written from scratch, so detections built for Evilgi |
From the original article
8 min read at bleepingcomputer.com
Attackers can steal credentials and begin exfiltrating data within minutes, often before security teams can respond. Exaforce examines real-world attacks involving stolen GitHub tokens, malicious AI installers, and MFA phishing, explaining why faster detection and automated containment are critical. [...]
By Sponsored by Exaforce · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.