Attackers impersonate CircleCI platform to compromise GitHub accounts

Threat actors target GitHub users to steal credentials and two-factor authentication (2FA) codes by impersonating the CircleCI DevOps platform.

GitHub is warning of an ongoing phishing campaign targeting its users to steal credentials and two-factor authentication (2FA) codes by impersonating the CircleCI DevOps platform.

The company learned of the attacks against its users on September 16, it pointed out that the phishing campaign has impacted many victim organizations except GitHub.

Phishing messages claims that a user’s CircleCI session expired and attempt to trick recipients into logging in using GitHub credentials.

“Clicking the link takes the user to a phishing site that looks like the GitHub login page but steals any credentials entered. For users with TOTP-based two-factor authentication (2FA) enabled, the phishing site also relays any TOTP codes to the threat actor and GitHub in real time, allowing the threat actor to break into accounts protected by TOTP-based 2FA. Accounts protected by hardware security keys are not vulnerable to this attack.” reads the advisory published by the Microsoft-owned company.

Recipients are redirected to the phishing pages mimicking GitHub login page designed to steal in real-time the credentials and 2FA code entered by the users.

The company pointed out that the accounts protected by hardware security keys are not vulnerable to this attack.

Among the tactics used by the attackers, they may quickly create GitHub personal access tokens (PATs), authorize OAuth applications, or add SSH keys to the account in order to maintain access to the account in case the user changes their password.

In other cases, the attackers were immediately downloading private repository contents accessible to the compromised user, including those owned by organization accounts and other collaborators.

The attackers use VPN or proxy providers to download private repository data via compromised user accounts.

If the case a compromised account has organization management permissions, the attackers may create new GitHub user accounts and add them to an organization in an effort to establish persistence.

Below is a list of known phishing domains that were used as part of this campaign:

circle-ci[.]comemails-circleci[.]comcircle-cl[.]comemail-circleci[.]com

“Upon conducting our analysis, we reset passwords and removed threat actor-added credentials for impacted users, and we notified all of the known-affected users and organizations that we discovered through our analysis. If you did not receive an email notice from us, then we do not have evidence that your account and/or organization was accessed by the threat actor at this time.” concludes the advisory. “We suspended all identified threat actor accounts, and we will continue to monitor for malicious activity and notify new victim users and organizations as needed.”

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, phishing)

---