Skip to Content

Dropbox phishing attack exposed some GitHub-stored code

Updated on 2022-11-06: Dropbox phishing attack exposed some GitHub-stored code

Cloud giant Dropbox confirmed a data breach this week affecting its development environment. Dropbox said in a post-mortem that no customer data, content, passwords or payment info was taken. While limited in nature and contained, the disclosure explains what went wrong and why. (Yes, even in this day and age that’s rare; credit where it’s due.) It seems similar in nature to LastPass’ breach earlier this year, and in terms of disclosure — detailed and transparent. Remember, it’s not that companies get breached. It’s how they handle the aftermath that matters… Uber, DoorDash, Mailchimp, Okta, Samsung — oh, there are just so many. Read more:

Updated on 2022-11-02: Dropbox: We Were Targeted in a Phishing Campaign

Dropbox has disclosed that it was the target of a phishing campaign in October after attackers managed to access Dropbox’s GitHub repositories. GitHub alerted Dropbox to suspicious activity. When Dropbox investigated, they learned that attackers had copied 130 code repositories. The incident is noteworthy because the attackers were able to bypass multi-factor authentication.


  • Looks like this was a phishing attack that took advantage of vulnerabilities in CircleCI’s (a widely used continuous integration platform) implementation of MFA. Like all security controls, if you implement them badly they don’t keep the bad guys out. Part of supply chain security is making sure vendors are showing evidence of having their software tested for vulnerabilities or open attack paths.
  • The Drobpox blog provides not only an explanation of how, even with multiple layers of defense, the attackers were able to get access, as well as an assessment of their then MFA solution. As convenient as OTP/TOTP and SMS are for MFA, current attack techniques include processes for leveraging their shortfalls. Use the analysis to support your case to move to phishing resistant MFA.


Updated on 2022-11-01

Dropbox confirmed suffering a phishing attack, leading to the intruder copying 130 of its private GitHub repositories and pilfering some confidential API credentials. Read more: Dropbox admits 130 of its private GitHub repos were copied after phishing attack

Overview: Dropbox phishing incident

File-sharing and file synchronization service Dropbox disclosed a minor security breach on Tuesday, revealing that a threat actor managed to compromise one of its employees through a phishing attack and gained access to one of its GitHub accounts. Dropbox said the intruder did not gain access to its core infrastructure where the files, personal data, and financial information of its users was being stored. However, Dropbox said the attackers did have access to repositories that stored API keys used by its developers and “a few thousand names and email addresses belonging to Dropbox employees, current and past customers, sales leads, and vendors.” Read more: How we handled a recent phishing incident that targeted Dropbox

    Ads Blocker Image Powered by Code Help Pro

    Your Support Matters...

    We run an independent site that\'s committed to delivering valuable content, but it comes with its challenges. Many of our readers use ad blockers, causing our advertising revenue to decline. Unlike some websites, we haven\'t implemented paywalls to restrict access. Your support can make a significant difference. If you find this website useful and choose to support us, it would greatly secure our future. We appreciate your help. If you\'re currently using an ad blocker, please consider disabling it for our site. Thank you for your understanding and support.