Coordinated Campaign Exploiting Compromised GitHub Personal Access Tokens

Between mid-May and early June 2026, Wiz CIRT identified a coordinated campaign targeting multiple organizations using compromised GitHub Personal Access Tokens (PATs). The attack followed a structured progression: initial repository reconnaissance via the GitHub API, a low-volume validation phase to confirm access, and finally, a massive, automated repository cloning operation. The activity was linked to automated tooling leveraging AWS and HostPapa infrastructure, utilizing distinct user agents for each campaign stage.

The incident highlights the critical risk of PAT exposure, as unauthorized access to private repositories frequently leads to the exposure of secondary secrets, including cloud credentials and API keys. Organizations are urged to audit GitHub PAT usage and monitor for anomalous cloning activity, specifically originating from non-standard IP ranges or appearing in high-parallelism bursts.

Attack Chain

1. Attacker obtains valid GitHub PATs through undisclosed means (likely endpoint compromise or credential exposure).
2. Reconnaissance phase (May 15): Attacker queries /repositories/{id}/readme endpoint via the GitHub API using an AWS IP (13.221.167.217) and Chrome browser user agent.
3. Validation phase (May 29-31): Attacker uses the compromised PATs to perform small-scale repository cloning from HostPapa infrastructure (107.174.201.183) to verify continued token validity.
4. Exfiltration phase (June 1): Attacker uses 102 AWS IP addresses in the ca-central-1 region to conduct mass, parallelized repository cloning.
5. Automated tools use git/2.43.0 user agent for high-concurrency cloning of thousands of repositories.
6. Attacker exfiltrates source code, enabling the identification of further hardcoded secrets within the stolen repositories.
7. Attacker potentially leverages discovered secrets (cloud credentials, API keys) to achieve follow-on compromise in downstream cloud environments.

Impact

The campaign resulted in the large-scale exfiltration of proprietary source code across multiple organizations. The primary danger of this exfiltration is the subsequent exposure of hardcoded secrets, such as API keys, cloud credentials, and private keys, found within the repositories, which provides the threat actor with a pathway to escalate access into the organizations' broader cloud infrastructure.

Recommendation

• Review GitHub audit logs for anomalous git.clone activity, specifically high volumes of repositories cloned by a single user account within a short timeframe.
• Identify and revoke compromised PATs; enforce SAML SSO for classic PATs and monitor fine-grained PAT usage for unauthorized scope.
• Implement GitHub Enterprise Log Streaming to gain visibility into API-based reconnaissance events that are not captured in standard audit logs.
• Perform an audit of hardcoded secrets in repositories that were accessed during the campaign window to determine if secondary credentials (cloud keys, etc.) were exposed.
• Isolate endpoints associated with the users whose PATs were compromised to check for additional credential theft or malware.