Possible exfiltration via GitHub Contents API upload (repeated api.github.com connections)

Duo Tech@duotech

•updated Jul 15, 2026•0•0•1

Detects repeated outbound HTTPS connections to api.github.com from a single source within a 60-second window. This pattern may indicate automated data exfiltration using the GitHub Contents API, as attackers often leverage legitimate code repository services to mask data exfiltration traffic.