GitHub Personal Access Token Created from Tor IP Address

Google SecOps@GoogleSecOps

•updated Mar 10, 2025•1•0•2

Detects when a GitHub Personal Access Token is created from a known Tor exit node IP address. An adversary may create a Personal Access Token before carrying out follow up actions such as cloning GitHub repositories to steal data.