CriticalPhishing
Machine speed attacks require machine speed detection and response
BleepingComputer·Source published ·1 min read
What happened?
Attackers can steal credentials and begin exfiltrating data within minutes, often before security teams can respond. Exaforce examines real-world attacks involving stolen GitHub tokens, malicious AI installers, and MFA phishing, explaining why faster detection and automated containment are critical. [...]
Key details
- Attackers enumerate or pull data within 15 minutes of initial access, and existing tools often fail to detect them.
- ClickFix lures for AI tools load macOS stealers that steal browser cookies and cloud credentials when victims run fake install commands.
- A developer's GitHub token sat in a Mac keychain for 95 days before being used to pull 76 repositories in 15 seconds from residential proxies across Europe.
- OAuth tokens prefixed gho_ do not expire and are only revoked by GitHub after a year; SSO pages do not list them and revoking the user in the identity provider does not stop the token.
What to look for
- Sign-ins from networks and cities never seen before on the account.
- Pulling ZIP archives at machine speed with a Windows user agent on an account that had only ever used macOS.
- New MFA method registered from a device and network the user has never touched.
- Attackers using the same servers and domains across multiple employee targets within the same company.
Summarised by SecOraLens from BleepingComputer. Always read the original source before acting. How SecOraLens verifies advisories.