What happened
GitHub issued a security alert on 21 September 2022 about a phishing campaign, first seen on 16 September, in which attackers impersonated the CI/CD service CircleCI to harvest GitHub credentials and time-based one-time passcodes. Attackers who succeeded immediately created personal access tokens, authorised OAuth apps or added SSH keys to keep access, and in some cases cloned private repositories and pushed changes. GitHub suspended affected accounts and reset credentials.
How the deception worked
Developers received emails claiming that CircleCI's terms of service and privacy policy had changed and that they needed to sign in to their GitHub account to keep using the service. The link led to a convincing GitHub log-in page under attacker control, which relayed the entered username, password and TOTP code to the real GitHub in real time. The pretext worked because CircleCI is a legitimate part of many developers' daily toolchain and a policy-update notice is mundane, while the audience, engineers with repository and token privileges, is exactly the population whose accounts unlock source code and downstream software supply chains.
The control that would have caught it· our reading, not a claim from the sources
Hardware security keys are the only MFA form that survives a real-time relay, and organisations should alert on new personal access tokens, OAuth grants and SSH keys added to developer accounts.
Sources (2)
- Security alert: new phishing campaign targets GitHub usersThe GitHub Blog·github.blogOpen ↗
- Hackers Using Fake CircleCI Notifications to Hack GitHub AccountsThe Hacker News·thehackernews.comOpen ↗
This entry summarises public reporting. It is not a legal finding, and details can change as investigations conclude. Found an error? Send a correction.