Skip to content

Back to the catalog

How to Investigate GitHub PAT Compromise: Lessons From a Multi-Organization Campaign
wiz.iowriteup

How to Investigate GitHub PAT Compromise: Lessons From a Multi-Organization Campaign

Wiz's Customer Incident Response Team (CIRT) details a real campaign (mid-May–early June 2026) in which stolen GitHub Personal Access Tokens were used for repository reconnaissance, low-volume validation cloning, and then mass exfiltration of thousands of repos per organization from AWS IPs using automated tooling. The post provides a structured investigation playbook — containing the compromised PAT, expanding the timeline via GitHub audit logs and Enterprise Log Streaming, tracing the leak source, assessing blast radius (exposed secrets/PII in exfiltrated repos), rotating credentials, and hunting for downstream cloud abuse — while noting GitHub's 7-day audit log retention limits visibility.

TL;DR Wiz CIRT walks through investigating a real multi-org GitHub PAT theft campaign that escalated from recon to mass repo exfiltration, with a full containment-to-hunt IR playbook.
Open original ↗
Document

What it is

Wiz CIRT's investigation playbook for compromised GitHub Personal Access Tokens, drawn from a multi-org campaign (mid-May–June 1, 2026). The value beyond the summary is in the specifics: the containment matrix keyed to PAT type, the log-source visibility gaps, and concrete IOCs.

Preconditions / Affected

Any org where employee PATs grant repo access. Containment capability depends on token type and identity config — this is the operational catch the summary omits:

  • Fine-grained PAT: org owners can view and revoke org access (revocation ≠ deleting the underlying token).
  • Classic PAT with SAML SSO enforced: owners can revoke SSO authorization (removes access to SSO-protected resources, doesn't delete token).
  • Classic PAT without SAML SSO: org/enterprise owners have no direct visibility or control. Only the user can delete it — or responders can revoke via REST API if they know the token value.
  • Enterprise Managed Users (EMU): enterprise can centrally delete a user's tokens. Wiz notes EMU is uncommon.

Because revocation can't always be independently verified, also temporarily remove the user from the org and consider isolating their endpoint.

Log-source visibility gaps

Two blind spots not in the summary:

  • Reconnaissance is invisible without Enterprise Log Streaming. The recon phase used the GitHub API /repositories/{id}/readme endpoint, generating api.request events — these exist only in Enterprise Log Streaming, not standard audit logs.
  • Personal security log. In non-EMU environments, org owners can't see a user's personal GitHub security log; the affected user must export it. EMU exposes equivalent events in the enterprise audit log.

Campaign IOCs

  • May 15 — recon from 13.221.167.217 (AWS EC2, us-east-1), Chrome UA (Chrome/125.0.0.0).
  • May 29–31 — validation cloning from 107.174.201.183 (HostPapa, US), UA git/2.25.1, small repo subset, ~05:42–05:44 UTC bursts.
  • June 1, 09:14–14:55 UTC — mass cloning from 102 AWS IPs in ca-central-1, UA git/2.43.0, thousands of repos/org.

Initial access vector was not identified — tokens weren't found in code or cloud resources across any impacted org; endpoint compromise is suspected but unconfirmed.

What to do

Ordering constraint the summary flattens: before rotating, document each credential (identifier, service, rotation time) — that inventory feeds the Step 6 hunt for pre-rotation abuse of leaked secrets. Then rotate all secrets found in exfiltrated repos (cloud creds, SaaS tokens, private keys, CI/CD, DB creds), and hunt each across cloud/SaaS control planes for use before rotation.

Caveats

Git events (git.clone, git.fetch, git.push) are retained by GitHub for only 7 days; unstreamed activity outside that window is unrecoverable, capping how completely exfiltration scope can be reconstructed. The playbook's queries and cross-platform correlation are framed around Wiz tooling.

Technologies named here

Techniques named here

  • Repository reconnaissance via GitHub API
  • Low-volume validation cloning
  • Mass repository cloning/exfiltration
  • Credential/secret harvesting from repositories
  • Follow-on use of leaked credentials

Threat actors named here

  • Unnamed GitHub PAT compromise campaign

Related in Blue Team & Detection