The 2022 phishing breach: 130 internal GitHub repositories stolen

In October 2022 Dropbox employees received phishing emails impersonating CircleCI, a code integration and delivery platform Dropbox used; a similar campaign against GitHub accounts had been publicly detailed by GitHub the month before. Dropbox later wrote: 'On October 14, 2022, GitHub alerted us to some suspicious behavior that began the previous day. Upon further investigation, we found that a threat actor—also pretending to be CircleCI—accessed one of our GitHub accounts, too.'

Dropbox described the mechanism directly: 'These legitimate-looking emails directed employees to visit a fake CircleCI login page, enter their GitHub username and password, and then use their hardware authentication key to pass a One Time Password (OTP) to the malicious site. This eventually succeeded, giving the threat actor access to one of our GitHub organizations where they proceeded to copy 130 of our code repositories.'

Dropbox said the stolen repositories 'included our own copies of third-party libraries slightly modified for use by Dropbox, internal prototypes, and some tools and configuration files used by the security team,' and did not include code for its 'core apps or infrastructure.' On the customer-data question, it was specific: 'At no point did this threat actor have access to the contents of anyone's Dropbox account, their password, or their payment information. To date, our investigation has found that the code accessed by this threat actor contained some credentials—primarily, API keys—used by Dropbox developers. The code and the data around it also included a few thousand names and email addresses belonging to Dropbox employees, current and past customers, sales leads, and vendors (for context, Dropbox has more than 700 million registered users).'