Documented incidentDisclosed 2022-11-03DropboxSEC filing

Phishing impersonating a CI vendor yields GitHub credentials and 130 source-code repositories (Dropbox, 2022)

Phishing emails impersonating CircleCI led an employee to a fake page where GitHub credentials and a one-time code were captured, giving the attacker access to a GitHub organization and 130 code repositories.

The failure pattern

Weak or phishable authentication on a privileged pathA password, an SMS code or a help-desk reset is all that stands between an attacker and admin access.How to prevent it Audit trail missing actor, target or decisionAfter something goes wrong nobody can tell who or what took the action, on which object, or why.How to prevent it
Watch the pattern: Weak or phishable authentication on a privileged path

Safeguards that address it

CollectSEA's engineering analysis of what would have prevented or contained this failure.

  • Require phishing-resistant authentication for code hostingUse origin-bound credentials (passkeys or hardware keys) so a lookalike page cannot replay a one-time code.
  • Keep secrets out of repositoriesScan repositories for API keys and rotate any credential found; store secrets in a vault.

Related standards

CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.

Building something similar?

Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.

Analyze your design

Incidents with the same pattern