> series: anatomy_of_a_breach —— part: 167 —— target: dropbox —— repos: 130 —— method: circleci_phishing —— stolen: source_code_api_keys<span class="cursor-blink">_</span>_
In November 2022, Dropbox disclosed that a phishing attack had compromised an employee's GitHub credentials by impersonating CircleCI — a CI/CD platform that Dropbox uses in its development pipeline. The employee received a convincing email appearing to come from CircleCI, clicked the link, and entered their GitHub username, password, and hardware authentication key on a fake login page. The attacker used the stolen credentials to access 130 of Dropbox's private GitHub repositories.
The compromised repositories contained copies of third-party libraries modified for Dropbox's use, internal prototypes, configuration files, and some data used by the security team — including employee names, email addresses, and a small number of customer email addresses. API keys were also exposed. Dropbox confirmed that no customer content, passwords, or payment information was accessed. The attack was part of a broader phishing campaign impersonating CircleCI that targeted multiple organisations — exploiting the trust developers place in their CI/CD pipeline tools.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallThe Dropbox breach demonstrated that developer-targeted phishing — impersonating trusted CI/CD tools — can bypass even hardware-backed MFA through real-time relay attacks. The only MFA method that fully resists this attack is FIDO2/WebAuthn, which cryptographically binds authentication to the legitimate domain. Cyber Essentials Danzell addresses phishing-resistant MFA. Our social engineering testing includes developer-targeted phishing. Infrastructure testing assesses source code repository security. SOC in a Box monitors for anomalous code repository access. And UK Cyber Defence provides incident response when developer infrastructure is compromised.
<a href="/penetration-testing/social-engineering">Social engineering testing</a> targets developers. <a href="/cyber-essentials">Cyber Essentials</a> addresses phishing-resistant MFA. <a href="/penetration-testing/infrastructure">Infrastructure testing</a> secures code repositories.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call