In early October 2022, Dropbox employees got phishing emails impersonating CircleCI that pointed them at a fake login page. According to the Dropbox Security Team, that page took GitHub usernames, passwords, and one-time passwords from hardware authentication keys. The attack succeeded against at least one Dropbox GitHub account and organization. The actor copied about 130 private repositories before GitHub alerted Dropbox on 14 October 2022 and access was disabled the same day. Dropbox reported no user content, user passwords, or payment data was touched.
If you want the prevention angle on why phishable hardware OTP failed at that login and what closes the harvest path, read the related article on mfa2point0.com.
FAQ
How did attackers get into Dropbox GitHub accounts in 2022?
Attackers got into at least one Dropbox GitHub account through CircleCI-themed phishing emails that sent employees to a fake login page. According to the Dropbox Security Team on 1 November 2022, employees entered a GitHub username and password, then used a hardware authentication key to pass a one-time password to the malicious site. That live credential harvest produced authenticated access to the Dropbox GitHub organization. Dropbox also noted that GitHub credentials could be used to log in to CircleCI, which is what the lure abused. Public reporting does not name a threat actor or publish exact recipient or click counts.
Did hardware MFA stop the Dropbox CircleCI phishing attack?
No. Hardware OTP MFA did not stop the Dropbox CircleCI phishing attack because the one-time password was handed to an attacker-controlled page along with the password. Dropbox wrote that threat actors had moved beyond harvesting usernames and passwords to harvesting multi-factor authentication codes as well, and that not all types of multi-factor authentication are created equal. The second factor here was a transferable code, so the fake CircleCI-styled GitHub login could collect it. Some of the phishing emails were automatically quarantined; others still reached inboxes.
What was taken after the Dropbox GitHub login succeeded?
After the compromised GitHub login, the attackers copied about 130 private code repositories from the Dropbox GitHub organization. According to Dropbox, those repositories held developer credentials, primarily API keys in code, plus a few thousand names and email addresses of employees, current and past customers, sales leads, and vendors. Dropbox stated that no Dropbox user content, user passwords, or payment information was accessed, and that core apps and infrastructure were unaffected. Once a live authenticated GitHub session existed, repository copy was no longer an MFA problem at the login form. Containment was disable-access, rotate credentials, and investigate.
How was the Dropbox GitHub compromise discovered and shut down?
GitHub alerted Dropbox on 14 October 2022 after suspicious behavior on a Dropbox GitHub account began on or about 13 October 2022. Dropbox said the threat actor’s GitHub access was disabled the same day, and credential rotation plus investigation started immediately. Around 1 November 2022 Dropbox published its findings and response. Public reporting does not establish successful external abuse of residual repository secrets after disclosure; Dropbox said log review and external forensics found no evidence of successful abuse of the exposed credentials.
Was the Dropbox incident part of the wider CircleCI GitHub phishing wave?
Dropbox framed its incident as the same or a similar CircleCI-impersonation campaign against GitHub accounts that GitHub had described in September 2022. The Dropbox path still hinged on a fake login page collecting GitHub passwords and hardware OTP codes from employees. Public reporting does not establish a named group behind the Dropbox hit, and it does not describe a device-code OAuth flow or a helpdesk reset path for this breach.
