PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

How to Investigate GitHub PAT Compromise: Lessons From a Multi-Organization Campaign

wiz.io | blog | #cloud | #incident-response | #github | #dfir | #playbook | #pat | #wiz | #token-compromise
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Wiz CIRT's playbook from a multi-org campaign: compromised PATs cloned thousands of repos from 102 AWS IPs on June 1; it covers containment, timeline reconstruction, blast-radius mapping and hunting.
Published
Collected

Related coverage

blog · wiz.io
LiteLLM Compromised, Steals Credentials
# LiteLLM Compromised, Steals Credentials In a new incident, a malicious version (1.107.0) of the LiteLLM package was uploaded to PyPI and Docker on October 21. The malicious version includes a...
blog · wiz.io
ASPM in the AI Era Part 2: Prioritize Exploitable Risks with Code-to-Cloud Context
Transform raw scanner output into actionable risk. Discover how Wiz ASPM enriches third-party findings, deduplicates alerts, and maps true attack paths.
blog · wiz.io
From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage
How a single Google Search ad click leads to credential theft, hijacking of cloud billing account, and hundreds of thousands of dollars incurred in unauthorized AI API usage
blog · wiz.io
Supply Chain Zero Days: Closing the Gap Between Publication and Detection
Attackers use compromised npm packages to spread malware in minutes. Discover how Wiz detects malicious packages at publication using AI and dynamic analysis.
blog · wiz.io
Loud, Fast, and Everywhere: Anatomy of a Real AI-Driven Cloud Attack
Wiz CIRT responded to AI-driven attacks spanning cloud, Kubernetes, CI/CD, and identity. Learn how these attacks behave and how to detect them.
research · wiz.io
The Blue Agent POV: Investigating Multi-Platform Data Exfiltration Across AWS and GitHub
Wiz's Blue Agent walks through investigating a multi-platform data exfiltration campaign spanning AWS, S3 and GitHub, showing how the agent gathers evidence and reconstructs the full attack chain in minutes instead of hours.
Back