---
id: 6773
title: "How to Investigate GitHub PAT Compromise: Lessons From a Multi-Organization Campaign"
source_domain: wiz.io
source_url: "https://www.wiz.io/blog/investigating-github-pat-compromise"
published_at: "2026-08-13T15:04:28Z"
tags: ["cloud", "incident-response", "github", "dfir", "playbook", "pat", "wiz", "token-compromise"]
phying_url: "https://phying.com/item/6773"
lang: en
---

# How to Investigate GitHub PAT Compromise: Lessons From a Multi-Organization Campaign

## Summary

Wiz CIRT's playbook from a multi-org campaign: compromised PATs cloned thousands of repos from 102 AWS IPs on June 1; it covers containment, timeline reconstruction, blast-radius mapping and hunting.

## Intelligence Metadata

- **Sources:** wiz.io
- **Published:** 2026-08-13T15:04:28Z
- **Original:** https://www.wiz.io/blog/investigating-github-pat-compromise
- **Phying News:** https://phying.com/item/6773