One token pulled 76 GitHub repositories in about 15 seconds; by the time any human action occurred the attacker had exfiltrated data from 472 of the 638 repos. That rapid sequence — observed and reported by Exaforce — encapsulates the report's central warning: attackers are operating at machine speed, and detection and response must match that tempo.
The GitHub token case: machine-speed exfiltration
Exaforce describes a March–June chain of events in which a developer installed GitHub Desktop in March, left its OAuth token in a Mac keychain for 95 days, and saw that token used by someone else starting on June 19. The token — an OAuth app token prefixed gho_ that does not expire by default — pulled 76 repositories in roughly 15 seconds from residential proxies across more than two dozen European cities. GitHub raised no alert because, the report notes, "nothing in GitHub watches how tokens are used." Exaforce's platform flagged the session within five minutes and triaged it within ten, but human-driven containment still lagged: by the time the MDR analyst notified the customer, 472 repos had already been accessed.
Stolen developer tokens and poisoned npm packages
Exaforce links these fast, early-stage breaches to developer workflows and poisoned packages. Their analysis shows worms like Shai‑Hulud sweep a machine for GitHub and cloud tokens the moment a poisoned npm package is installed. Those tools run outside CI pipelines and can grab tokens from developer laptops before any code is committed, so repository scanning after the fact is "not sufficient," the report warns. The platform detected the GitHub compromise by combining weak signals — unfamiliar networks and cities, ZIP archive downloads at machine speed, and a Windows user agent on an account that had only used macOS — and treating the combination as malicious.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildClickFix lures and AI-tool install commands
Another pattern Exaforce documents targets trust around AI coding tools. In one incident, an employee searching for "Claude Code install instructions" encountered a shared Claude chat containing a one-line install command. Running that command loaded a macOS stealer that faked a System Preferences password prompt, then copied the keychain, browser cookies, saved passwords, and cloud credentials. Because the victim executed the installer themselves, email filters and download controls were bypassed. Exaforce recommends endpoint detection as the most effective way to catch these attacks and advocates for a comprehensive analysis of all tokens and credentials minted by the user to assess scope.
Help-desk vishing, session hijacks, and MFA abuse
Exaforce documents vishing campaigns in which attackers pose as IT, guide employees to look-alike sign-in pages (for example, the passkey-themed contoso.add-passkey[.]com cited in Microsoft's September write-up), obtain MFA approval, register an MFA device, and then begin bulk downloads minutes later. One kit the analysts dissected was hosted on oskeysetup[.]com and was written from scratch, meaning public AiTM-kit detections may not catch it. The report notes identity providers can mark the sign-in as legitimate after the victim passes MFA; in a July case Microsoft flagged the initial sign-in as risky, then marked the risk remediated because the user passed MFA, while attackers replayed the stolen token from two other countries within one second. Exaforce tied Okta and Microsoft sign-ins together and detected first-ever sign-ins from new countries, devices, and home ISPs — often the earliest strong signal.
Autonomous response: low-friction actions and APIs to implement now
To close the human-speed gap, Exaforce recommends moving toward autonomous response but sorting actions by friction. Low-friction, high-confidence actions that can be automated include revoking sessions, removing an MFA method registered during the flagged session, and deactivating a key that can be switched back on. The report lists concrete API actions and required permissions for key services, for example:
- Okta: DELETE /api/v1/users/{{id}}/sessions?oauthTokens=true to revoke sessions and tokens (requires okta.users.read and okta.users.manage scopes and a custom admin role).
- Microsoft Entra ID: POST /users/{{id}}/revokeSignInSessions to revoke refresh tokens and session cookies, plus DELETE /users/{{id}}/authentication/{{type}}Methods/{{methodId}} to delete MFA methods (requires User.RevokeSessions.All and UserAuthenticationMethod.ReadWrite.All respectively).
- GitHub Enterprise Cloud (org-level SAML SSO): GET /orgs/{{org}}/credential-authorizations?login={{user}} then DELETE /orgs/{{org}}/credentialauthorizations/{{credential_id}} to remove a stolen token (requires an org owner or a GitHub App with org Administration write).
- Snowflake, AWS, Google Workspace, and AI providers such as Anthropic are listed with comparable revocation APIs and permission notes in the report.
Exaforce emphasizes building per-application revocation actions ahead of time and authorizing the service accounts that will run them; they note failed response attempts when required permissions were not in place and that some IdP revocations do not reach all services, allowing exfiltration to continue for between 44 minutes and 3 hours after an IdP session was revoked in their cases.
What security teams, procurement leaders, and end users will do
Security teams will be watching for "machine-speed" indicators: ZIP downloads at machine pace, first‑ever sign-ins from new countries and devices, and new MFA methods registered during suspicious sessions. Procurement leaders should prioritize services that hold critical data — Google Workspace, Office 365, Slack, AWS, GCP, Azure, Snowflake, Databricks, GitHub, GitLab, and AI services such as Anthropic and OpenAI — and ensure response automation is permitted and provisioned. End users will face more low-friction rollback actions (session revocations, factor resets) and should expect brief re-enrollment steps when high-confidence detections trigger automated containment.
The takeaway in Exaforce's account is stark and specific: detection must be behavioral and real‑time, and response must be autonomous for low-friction actions. Otherwise, machine-speed attackers will continue to outpace human operators and the protections that rely solely on legacy controls.
