Attackers began enumerating or pulling data within 15 minutes of gaining access in three attack patterns analyzed by Exaforce, according to a BleepingComputer report sponsored by the security company.
The most detailed case involved a dormant GitHub OAuth token created during a GitHub Desktop installation. Exaforce said the token was later used to download 76 repositories in about 15 seconds through residential proxies spanning more than two dozen European cities. Its platform detected the activity within five minutes and completed triage within 10 minutes, but the attacker had already exfiltrated data from 472 of the 638 repositories accessible to the account.
A separate Exaforce case study says the token had remained unused for 95 days before the activity began. The company attributed the detection to a combination of signals, including new locations, a Windows user agent on an account previously using macOS, and automated repository downloads. The case study says the token was a classic GitHub OAuth App token, which has no fixed expiration and is automatically revoked by GitHub only after a full year of inactivity.
The current analysis also describes fake Claude Code installation instructions that delivered a macOS information stealer, and help-desk impersonation attacks in which victims approved genuine MFA prompts. Exaforce says those incidents allowed attackers to obtain browser cookies, cloud credentials or authenticated sessions while evading controls that rely on a single identity-provider alert.
The report recommends behavior-based detection and response actions such as revoking sessions, removing newly registered MFA methods and deactivating compromised keys. It says higher-impact actions, including password resets, account disablement and changes affecting production services, should require human approval. The report does not identify a CVE, vendor patch or confirmed broader scope for the cases described.