Hackers Compromised CircleCI Employee’s Laptop to Breach the Company’s Systems

CircleCI, a DevOps platform, discovered that malware installed on a CircleCI engineer’s laptop was used by an unauthorized third party to steal a legitimate, 2FA-backed SSO session.

On December 16, 2022, this device was compromised. The company’s antivirus programme was unable to detect the malware.

“Our investigation indicates that the malware was able to execute session cookie theft, enabling them to impersonate the targeted employee in a remote location and then escalate access to a subset of our production systems”, according to the CircleCI incident report.

Reports say the unauthorized third party had access to and was able to exfiltrate data from a subset of databases and stores, including customer environment variables, tokens, and keys because the targeted employee had the authority to generate production access tokens as part of the employee’s regular duties.

On December 19, 2022, the threat actor is suspected to have conducted reconnaissance, which was followed by data exfiltration on December 22, 2022.

In order to potentially gain access to the encrypted data, the third-party extracted the encryption keys from a running process.

Additional Layers of Protection are Implemented

The company stated that additional detection and blocking of the specific behaviors displayed by the malware employed in this assault through MDM and A/V solutions are implemented. They have restricted access to production environments to a very small number of employees. 

Further, the company said implemented more stringent authentication rules and procedures to guard against potential unauthorized production access. A monitoring and alerting system were put in place for the specified behavioral patterns.

The change occurred a little over a week after CircleCI advised its users to rotate all of their secrets. The company said that this was necessary as a result of “suspicious GitHub OAuth behavior” that was reported to them by one of its users on December 29, 2022.

The company said it worked with Atlassian to rotate all Bitbucket tokens, revoked Project API Tokens, and Personal API Tokens, informed customers of potentially affected AWS tokens, and proactively took the step of rotating all GitHub OAuth tokens after learning that the customer’s OAuth token had been compromised.

How Can I Determine Whether Data Is At Risk?

“We recommend you investigate for suspicious activity in your system starting on December 16, 2022, and ending on the date you completed your secrets rotation after our disclosure on January 4, 2023. Anything entered into the system after January 5, 2023, can be considered secure”, says the report


  • Use OIDC tokens wherever possible to avoid storing long-lived credentials in CircleCI.
  • Use IP ranges to restrict inbound connections to just known IP addresses for your systems.
  • Contexts can be used to group shared secrets, limit access to them to certain projects, and cycle them automatically.
  • For privileged access and additional controls, choose to use runners, which allow you to connect the CircleCI platform to your own compute and environments, including IP restrictions and IAM management.

Network Security Checklist – Download Free E-Book

Guru baran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Sleepy Pickle Exploit Let Attackers Exploit ML Models And Attack End-Users

Hackers are targeting, attacking, and exploiting ML models. They want to hack into these systems to steal sensitive data, interrupt…

2 days ago

SolarWinds Serv-U Vulnerability Let Attackers Access sensitive files

SolarWinds released a security advisory for addressing a Directory Traversal vulnerability which allows a threat actor to read sensitive files…

2 days ago

Smishing Triad Hackers Attacking Online Banking, E-Commerce AND Payment Systems Customers

Hackers often attack online banking platforms, e-commerce portals, and payment systems for illicit purposes. Resecurity researchers have recently revealed that…

2 days ago

Threat Actor Claiming Leak Of 5 Million Ecuador’s Citizen Database

A threat actor has claimed responsibility for leaking the personal data of 5 million Ecuadorian citizens. The announcement was made…

3 days ago

Ascension Hack Caused By an Employee Who Downloaded a Malicious File

Ascension, a leading healthcare provider, has made significant strides in its investigation and recovery efforts following a recent cybersecurity breach.…

3 days ago

AWS Announced Malware Detection Tool For S3 Buckets

Amazon Web Services (AWS) has announced the general availability of Amazon GuardDuty Malware Protection for Amazon Simple Storage Service (Amazon…

3 days ago