Sponsored analysis: stolen GitHub tokens, ClickFix lures for Claude Code and help desk vishing enable data theft within minutes
A vendor-sponsored analysis by Exaforce (published on bleepingcomputer.com) says attackers are enumerating or exfiltrating data within about 15 minutes of gaining access. It describes three patterns: stolen developer GitHub OAuth tokens, ClickFix lures that impersonate Claude Code install instructions to deliver a macOS stealer, and help desk vishing that ends in hijacked sessions. The article says native tooling (GitHub, identity providers, endpoint controls) often fails to detect these. In the GitHub case, a token sat dormant for 95 days, then pulled 76 repositories in about 15 seconds, and data from 472 of 638 repos was exfiltrated before containment. The vendor argues for autonomous, low-friction response actions and promotes its Agentic SOC and MDR platform.
Detalhes técnicos
- GitHub token abuse: an OAuth token (prefix
gho_) created by GitHub Desktop was used from residential proxies in more than two dozen European cities, with a Windows user agent on an account that had only used macOS. The article says these tokens do not expire, GitHub revokes them on its own only after a year, they are not listed on the SSO page in the vendor's testing (visible only via CLI), and disabling the user in the IdP does not invalidate them. Poisoned npm packages and worms such as Shai-Hulud harvest GitHub and cloud tokens from developer machines. - ClickFix for AI tools: an employee searching for Claude Code install instructions landed on a shared Claude conversation with a one-line install command. It loads a macOS stealer that fakes a System Preferences password prompt, then copies the keychain, browser cookies, saved passwords and cloud credentials. The victim runs the command, which bypasses email filtering and download controls.
- Help desk vishing: attackers posing as IT send victims to look-alike sign-in pages (e.g. contoso.add-passkey[.]com, oskeysetup[.]com), using an AiTM proxy or a device-code sign-in. The attacker registered their own MFA device and started bulk downloads within 2.5 to 7 minutes of the push approval. In one case 140,000 files were exfiltrated and a ransom was demanded. The article says the kit on oskeysetup[.]com was custom-written, so Evilginx-focused detections would miss it, and the script resembles that commonly used by Scattered Spider. In a July case, Microsoft marked the risk remediated after the user passed MFA, and the stolen token was replayed from two other countries within one second.
- Post-revocation persistence: exfiltration continued 44 minutes to 3 hours after IdP session revocation, and in one case the attacker's inbox rules survived a password reset. Okta Universal Logout does not reach GitHub, Snowflake or AI model providers.
Remediação
- Revoke tokens and sessions per application, not only at the IdP (Okta, Microsoft 365, Google Workspace, GitHub, Snowflake, AWS, AI providers), and pre-provision the permissions and service accounts needed to run these actions.
- Treat actions as low-friction (revoke sessions, remove an MFA method registered in the flagged session, deactivate a reversible key) and automate them on high-confidence findings. Require human approval for password resets, account disablement and permanent deletions.
- After an infostealer infection, assess all tokens and credentials minted by the user. Scanning repositories alone is insufficient for npm compromise.
- Alert on a new MFA method from a device and network the user has never used, and on token use from new networks or user agents.
Linha do tempo
-
Sponsored analysis: stolen GitHub tokens, ClickFix lures for Claude Code and help desk vishing enable data theft within minutes
ler a análise desta fonte ocultar
A vendor-sponsored analysis by Exaforce (published on bleepingcomputer.com) says attackers are enumerating or exfiltrating data within about 15 minutes of gaining access. It describes three patterns: stolen developer GitHub OAuth tokens, ClickFix lures that impersonate Claude Code install instructions to deliver a macOS stealer, and help desk vishing that ends in hijacked sessions. The article says native tooling (GitHub, identity providers, endpoint controls) often fails to detect these. In the GitHub case, a token sat dormant for 95 days, then pulled 76 repositories in about 15 seconds, and data from 472 of 638 repos was exfiltrated before containment. The vendor argues for autonomous, low-friction response actions and promotes its Agentic SOC and MDR platform.
Technical Details
- GitHub token abuse: an OAuth token (prefix
gho_) created by GitHub Desktop was used from residential proxies in more than two dozen European cities, with a Windows user agent on an account that had only used macOS. The article says these tokens do not expire, GitHub revokes them on its own only after a year, they are not listed on the SSO page in the vendor's testing (visible only via CLI), and disabling the user in the IdP does not invalidate them. Poisoned npm packages and worms such as Shai-Hulud harvest GitHub and cloud tokens from developer machines. - ClickFix for AI tools: an employee searching for Claude Code install instructions landed on a shared Claude conversation with a one-line install command. It loads a macOS stealer that fakes a System Preferences password prompt, then copies the keychain, browser cookies, saved passwords and cloud credentials. The victim runs the command, which bypasses email filtering and download controls.
- Help desk vishing: attackers posing as IT send victims to look-alike sign-in pages (e.g. contoso.add-passkey[.]com, oskeysetup[.]com), using an AiTM proxy or a device-code sign-in. The attacker registered their own MFA device and started bulk downloads within 2.5 to 7 minutes of the push approval. In one case 140,000 files were exfiltrated and a ransom was demanded. The article says the kit on oskeysetup[.]com was custom-written, so Evilginx-focused detections would miss it, and the script resembles that commonly used by Scattered Spider. In a July case, Microsoft marked the risk remediated after the user passed MFA, and the stolen token was replayed from two other countries within one second.
- Post-revocation persistence: exfiltration continued 44 minutes to 3 hours after IdP session revocation, and in one case the attacker's inbox rules survived a password reset. Okta Universal Logout does not reach GitHub, Snowflake or AI model providers.
Remediation
- Revoke tokens and sessions per application, not only at the IdP (Okta, Microsoft 365, Google Workspace, GitHub, Snowflake, AWS, AI providers), and pre-provision the permissions and service accounts needed to run these actions.
- Treat actions as low-friction (revoke sessions, remove an MFA method registered in the flagged session, deactivate a reversible key) and automate them on high-confidence findings. Require human approval for password resets, account disablement and permanent deletions.
- After an infostealer infection, assess all tokens and credentials minted by the user. Scanning repositories alone is insufficient for npm compromise.
- Alert on a new MFA method from a device and network the user has never used, and on token use from new networks or user agents.
- GitHub token abuse: an OAuth token (prefix