GitHub Access Granted To Personal Access Token Followed By High Number Of Cloned Non Public Repositories

Google SecOps@GoogleSecOps

•updated Mar 10, 2025•1•0•2

Detects when a user grants access to a GitHub Personal Access Token prior to cloning several GitHub non-public GitHub repositories. An adversary may grant access to a Personal Access Token before attempting to steal the contents of several GitHub repositories using a an automated script or offensive tool.