Exaforce Details Token Theft, ClickFix and Vishing Attacks—and Response Steps
Summary
Exaforce describes token theft, ClickFix lures and help-desk vishing cases, then recommends behavior-based detection and prebuilt, low-friction revocation actions to limit data theft after account compromise.
Key points
- Exaforce says one stolen GitHub OAuth token pulled 76 repositories in about 15 seconds; its platform detected the activity within five minutes, but data was exfiltrated from 472 repositories before action.
- The article says poisoned npm packages and infostealers can steal developer tokens, while GitHub may not alert on token misuse.
- A reported ClickFix lure used a shared Claude conversation to deliver a command that installed a macOS stealer targeting the keychain, browser data and cloud credentials.
- In reported vishing cases, attackers impersonated IT, obtained approval of real MFA prompts and used stolen sessions to download data; one case involved 140,000 files and a ransom demand.
- The article recommends behavior-based detection that correlates identity-provider sign-ins with a user's history, including unfamiliar devices, networks and locations.
- It advises automating lower-impact actions such as revoking sessions and removing newly registered MFA methods, while requiring human approval for higher-impact actions.
- Revoking an identity-provider session may not terminate sessions or tokens already issued by connected services; the article provides API-based revocation examples for several platforms.
Article Details
- Defense Focus
- Detect rapid token misuse, credential theft, and session hijacking by correlating identity, endpoint, network, and application behavior, then contain confirmed incidents through appropriately authorized automated response.
- Detection Methods
- Correlate sign-ins with the user's historical networks, cities, devices, and identity-provider activity; flag novel combinations such as first-time locations, Linux devices, or previously unseen home ISPs.
- Detect unusual GitHub token activity by combining new network or city, rapid repository archive downloads, and a user agent inconsistent with the account's normal operating system.
- Monitor for newly registered MFA methods during suspicious sessions and correlate subsequent sign-ins or token use across identity providers and applications.
- Use endpoint detection to identify user-executed install commands that launch credential-stealing activity, including collection of keychains, browser cookies, saved passwords, and cloud credentials.
- Investigate tokens and credentials minted by a user to assess the impact of suspected infostealer activity.
- Hunt for related activity across employees because multiple targets may be attacked using the same servers and domains.
- Data Sources
- GitHub token and repository activity, including archive downloads, user agents, and source networks
- Identity-provider sign-in records and user history from Okta and Microsoft
- MFA method registration and authentication events
- Endpoint telemetry for command execution and credential or keychain access
- Application session and token activity across SaaS, cloud, code, and data services
- Platforms
- Exaforce platform
- Defensive Actions
- Revoke compromised sessions and application-issued OAuth tokens; do not assume that revoking an identity-provider session invalidates sessions or tokens issued by connected applications.
- Remove MFA methods registered during the flagged session and deactivate credentials that can be re-enabled.
- Prepare and test application-specific revocation procedures and ensure the accounts executing them have the required permissions.
- Automate low-friction containment actions for high-confidence findings; require human approval for password resets, account disablement, permanent deletion, or changes affecting production services.
- Prioritize revocation coverage for services holding critical data, including code repositories, cloud environments, productivity platforms, AI services, and data platforms.
- After suspected credential theft, assess all tokens and credentials minted by the affected user and revoke those at risk.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | contoso[.]add-passkey[.]com | Passkey-themed look-alike sign-in domain cited as an example of attacker-directed phishing. |
| DOMAIN | oskeysetup[.]com | Domain hosting a custom vishing-related phishing kit described in the article. |
MITRE ATT&CK
T1059.004 · Unix ShellClickFix lures provide a one-line install command that the victim executes to load a macOS stealer.T1078 · Valid AccountsAttackers use stolen GitHub OAuth tokens and hijacked user sessions to access repositories and other services.T1528 · Steal Application Access TokenThe attacker obtains and reuses authentication tokens, including tokens stolen from developer machines and replayed after session hijacking.T1539 · Steal Web Session CookieThe macOS stealer collects browser cookies.T1552.001 · Credentials In FilesPoisoned npm packages and infostealers are described as collecting GitHub and cloud tokens from developer machines.T1555.001 · KeychainThe macOS stealer copies the victim's keychain after prompting for a password.T1555.003 · Credentials from Web BrowsersThe stealer copies saved passwords from the victim's browser.T1557 · Adversary-in-the-MiddleThe phishing kit can relay login activity through an adversary-in-the-middle proxy.T1567 · Exfiltration Over Web ServiceStolen tokens are used to exfiltrate repository data and other files from cloud and SaaS services.T1621 · Multi-Factor Authentication Request GenerationVishing attackers induce victims to approve a real MFA push prompt.
Threat Actors
Malware
Vendors
Products
AnthropicAI services: Anthropic, OpenAIAWSResetting the user's Okta password or killing their Okta session doesn't revoke tokens that Microsoft 365, Google Workspace, or GitHub already issued, and AWS and Snowflake sessions started through SSO keep running.GitHub DesktopIn March, a developer installed GitHub Desktop, signed in, and stopped using it the same day.GitHub Enterprise CloudGitHub Enterprise Cloud, orglevel SAML SSOGoogle WorkspaceResetting the user's Okta password or killing their Okta session doesn't revoke tokens that Microsoft 365, Google Workspace, or GitHub already issued, and AWS and Snowflake sessions started through SSO keep running.OktaExaforce caught it by tying the Okta and Microsoft sign-ins together and checking them against the user's history: this was the account's first-ever sign-in from the United States, on a Linux device, and through a homeSnowflakeResetting the user's Okta password or killing their Okta session doesn't revoke tokens that Microsoft 365, Google Workspace, or GitHub already issued, and AWS and Snowflake sessions started through SSO keep running.