Thursday, April 18, 2024

Hackers Compromised CircleCI Employee’s Laptop to Breach the Company’s Systems

CircleCI, a DevOps platform, discovered that malware installed on a CircleCI engineer’s laptop was used by an unauthorized third party to steal a legitimate, 2FA-backed SSO session.

On December 16, 2022, this device was compromised. The company’s antivirus programme was unable to detect the malware.

“Our investigation indicates that the malware was able to execute session cookie theft, enabling them to impersonate the targeted employee in a remote location and then escalate access to a subset of our production systems”, according to the CircleCI incident report.

Reports say the unauthorized third party had access to and was able to exfiltrate data from a subset of databases and stores, including customer environment variables, tokens, and keys because the targeted employee had the authority to generate production access tokens as part of the employee’s regular duties.

On December 19, 2022, the threat actor is suspected to have conducted reconnaissance, which was followed by data exfiltration on December 22, 2022.

In order to potentially gain access to the encrypted data, the third-party extracted the encryption keys from a running process.

Additional Layers of Protection are Implemented

The company stated that additional detection and blocking of the specific behaviors displayed by the malware employed in this assault through MDM and A/V solutions are implemented. They have restricted access to production environments to a very small number of employees. 

Further, the company said implemented more stringent authentication rules and procedures to guard against potential unauthorized production access. A monitoring and alerting system were put in place for the specified behavioral patterns.

The change occurred a little over a week after CircleCI advised its users to rotate all of their secrets. The company said that this was necessary as a result of “suspicious GitHub OAuth behavior” that was reported to them by one of its users on December 29, 2022.

The company said it worked with Atlassian to rotate all Bitbucket tokens, revoked Project API Tokens, and Personal API Tokens, informed customers of potentially affected AWS tokens, and proactively took the step of rotating all GitHub OAuth tokens after learning that the customer’s OAuth token had been compromised.

How Can I Determine Whether Data Is At Risk?

“We recommend you investigate for suspicious activity in your system starting on December 16, 2022, and ending on the date you completed your secrets rotation after our disclosure on January 4, 2023. Anything entered into the system after January 5, 2023, can be considered secure”, says the report


  • Use OIDC tokens wherever possible to avoid storing long-lived credentials in CircleCI.
  • Use IP ranges to restrict inbound connections to just known IP addresses for your systems.
  • Contexts can be used to group shared secrets, limit access to them to certain projects, and cycle them automatically.
  • For privileged access and additional controls, choose to use runners, which allow you to connect the CircleCI platform to your own compute and environments, including IP restrictions and IAM management.

Network Security Checklist – Download Free E-Book


Latest articles

Xiid SealedTunnel: Unfazed by Yet Another Critical Firewall Vulnerability (CVE-2024-3400)

In the wake of the recent disclosure of a critical vulnerability (CVE-2024-3400) affecting a...

Cerber Linux Ransomware Exploits Atlassian Servers to Take Full Control

Security researchers at Cado Security Labs have uncovered a new variant of the Cerber...

FGVulDet – New Vulnerability Detector to Analyze Source Code

Detecting source code vulnerabilities aims to protect software systems from attacks by identifying inherent...

North Korean Hackers Abuse DMARC To Legitimize Their Emails

DMARC is targeted by hackers as this serves to act as a preventative measure...

L00KUPRU Ransomware Attackers discovered in the wild

A new variant of the Xorist ransomware, dubbed L00KUPRU, has been discovered in the...

Oracle Releases Biggest Security Update in 2024 – 372 Vulnerabilities Are Fixed – Update Now!

Oracle has released its April 2024 Critical Patch Update (CPU), addressing 372 security vulnerabilities...

Outlook Login Panel Themed Phishing Attack Evaded All Antivirus Detections

Cybersecurity researchers have uncovered a new phishing attack that has bypassed all antivirus detections.The...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.


Mastering WAAP/WAF ROI Analysis

As the importance of compliance and safeguarding critical websites and APIs grows, Web Application and API Protection (WAAP) solutions play an integral role.
Key takeaways include:

  • Pricing models
  • Cost Estimation
  • ROI Calculation

Related Articles