A security firm says attackers copied company code and files within minutes of getting in, often before anyone could step in. Here is how, and what to ask.
Attackers are pulling data out of company systems within about 15 minutes of getting in, according to security firm Exaforce. In one case, a stolen login token copied code from 472 of a company's 638 code folders before anyone acted on the alert. The firm describes three real attack patterns. Its analysis is also a pitch for its own detection products.
In March, a developer installed GitHub Desktop, signed in, and stopped using it the same day. The sign-in left behind a token, a digital key that proves who you are. It sat on a Mac for 95 days. On June 19, someone else started using it. That person pulled 76 code folders in about 15 seconds, routing traffic through home internet connections in more than two dozen European cities.
GitHub raised no alert, because it does not watch how tokens are used. Exaforce flagged the activity within five minutes. Its analysts confirmed the theft and told the customer within minutes. Still, containing it needed a human to approve, and by then the data was gone.
Exaforce says tokens of this type do not expire, and GitHub revokes them on its own only after a year. In its testing, the company's single sign-on page did not list them. Disabling the developer in the company's login system did not stop the token either. Without a user-syncing feature called SCIM, GitHub keeps honoring tokens until someone revokes them or removes the person from the organization.
One employee searched for install steps for Claude Code, an AI coding tool, and landed on a shared Claude conversation with a one-line install command. Running it handed over access. Because the employee ran the command, email filters and download controls were bypassed.
The third pattern is phone scams. A caller posing as IT sends an employee to a fake sign-in page. The employee approves a real login prompt. The attacker then registers their own MFA device, the second step used to confirm a login, and starts a bulk download 2.5 to 7 minutes later. In one case, 140,000 files were taken and a ransom was demanded.
Exaforce says login providers often miss this because the victim passes a genuine MFA check. In one July case, Microsoft marked an early risky sign-in as fixed after the user passed MFA.
The firm argues for automatic response that does not wait for a person. It suggests sorting actions by how much a mistake would cost the account owner. Low-cost actions can fire when the system is confident something is wrong:
The practical question is how fast your team can cut off a stolen session or key. Ask who can approve that step, and how long it takes. The material does not say how common these attacks are overall.
Ask your team how quickly it can cut off a stolen login session or key, and whether that step waits on a person's approval.
A user says Anthropic's Claude Code put his email in web requests, then scam messages arrived. The link is unproven, but it shows what AI tools can share.
Read more: User says Claude Code sent his email address to websitesNorth Dakota lawmakers are looking at HB 1447, a bill meant to help prevent crypto fraud, and AARP wants residents to speak up.
Read more: North Dakota weighs a bill to curb crypto scamsA modified Gboard called GboardWu Privacy keeps the features of Google's keyboard but stops it from sending usage data back to Google.
Read more: A modded Google keyboard keeps its features but blocks tracking
