CircleCI published an incident report stating that malware deployed on an engineer’s laptop on 16 December 2022 was used to steal a 2FA-backed single sign-on session. The company was alerted to suspicious activity on 29 December, began rotating GitHub OAuth tokens on behalf of customers on 31 December, and learned the full picture on 4 January 2023.
The company reported that the targeted employee had privileges to generate production access tokens as part of their normal duties, and that data was taken from a subset of databases and stores including customer environment variables, tokens and keys.
Two-Factor Was Satisfied, Not Bypassed
The stolen artefact was a session cookie. A session exists because authentication already happened, which means every factor had been presented correctly by the real employee before the theft.
This is the same failure the corpus files at 23-1010 for Citrix Bleed and at 23-1020 for the HAR files in Okta’s support system. Three unrelated products, one shape: the credential that matters is not the password, it is the thing issued after the password.
The Blast Radius Was Everybody Else’s
CircleCI is a continuous integration service. The secrets it holds are its customers’ — the tokens and keys those customers use to deploy their own software. A compromise here is a compromise of everyone downstream, and the remediation was correspondingly total: rotate everything, everywhere.
The corpus files build systems as a distinct target class at 25-0711 and 25-0717. A build pipeline is the one place in an organisation that legitimately holds credentials to everything else.
Encryption Keys Were Taken From Memory
Reporting of the incident describes encryption keys being dumped from running processes, which would allow the stolen encrypted data to be decrypted.
Encryption at rest defends against someone taking the disk. It does not defend against someone standing inside the process that holds the key, which is a distinction that rarely survives into a compliance questionnaire.
Built on CircleCI’s own published incident report for the 4 January 2023 incident and on contemporaneous technical reporting. The 16 December compromise date, the 2FA-backed session theft, the employee’s token-generation privileges and the categories of exfiltrated data are the company’s. The detail of encryption keys dumped from running processes is from reporting of the company’s post-mortem and is stated as reported. No actor attribution is made and no count of affected customers is asserted — the company rotated secrets universally rather than enumerating victims. No indicators are reproduced. Graded high. Corrections: corrections@forensicpost.com.