Threat actors targeted GitHub users with a phishing campaign impersonating CircleCI to harvest credentials and 2FA codes, affecting many organizations even though GitHub itself was not breached. Attackers leverage stolen credentials to persist, access private repos, and exfiltrate data using compromised accounts across organizations. #CircleCI #GitHub #2FA #PAT #OAuth #SSHKeys
Keypoints
- Phishing campaign impersonated CircleCI to harvest GitHub credentials and TOTP-based 2FA codes.
- After credential theft, attackers may quickly create personal access tokens, authorize OAuth apps, or add SSH keys to preserve access.
- Compromised accounts are used to immediately download private repository contents, including organization-owned repos.
- Attackers employ VPNs or proxy services to download data via compromised accounts, aiding evasion.
- If an account has organization management, attackers may create new user accounts and add them to an organization for persistence.
- Known phishing domains used in the campaign include circle-ci[.]com, emails-circleci[.]com, circle-cl[.]com, email-circleci[.]com, and links-circleci[.]com.
- GitHub responded by resetting passwords, removing attacker-added credentials, suspending identified accounts, and advising customers on phishing defenses.
MITRE Techniques
- [T1566.001] Phishing: Spearphishing Link – The threat actor uses phishing messages linked to a site impersonating legitimate services to harvest credentials and 2FA codes. “Clicking the link takes the user to a phishing site that looks like the GitHub login page but steals any credentials entered. For users with TOTP-based two-factor authentication (2FA) enabled, the phishing site also relays any TOTP codes to the threat actor and GitHub in real time”
- [T1136] Create Account – The threat actor may create GitHub personal access tokens, authorize OAuth apps, or add SSH keys to preserve access, potentially by manipulating accounts. “If a compromised account has organization management permissions, the threat actor may create new GitHub user accounts and add them to an organization in an effort to establish persistence.”
- [T1078] Valid Accounts – Stolen credentials enable ongoing access and actions across victim organizations and repos. “If the threat actor steals GitHub user account credentials, they may quickly create PATs… and add SSH keys to the account”
- [T1041] Exfiltration: Exfiltration Over Web Services/Information Repositories – The attacker downloads private repository contents accessible to the compromised user, including those owned by organization accounts. “the threat actor immediately downloads private repository contents accessible to the compromised user”
- [T1090] Proxy – The threat actor uses VPN or proxy providers to download private repository data via compromised user accounts. “The threat actor uses VPN or proxy providers to download private repository data via compromised user accounts.”
- [T1136] Create Account – Persistence via organization may involve creating new accounts and adding them to orgs. “If a compromised account has organization management permissions, the threat actor may create new GitHub user accounts and add them to an organization in an effort to establish persistence.”
Indicators of Compromise
- [Domain] Phishing domains – circle-ci[.]com, emails-circleci[.]com, circle-cl[.]com, email-circleci[.]com, links-circleci[.]com
Read more: https://github.blog/2022-09-21-security-alert-new-phishing-campaign-targets-github-users/