File hosting service Dropbox announced that threat actors gained unauthorized access to 130 of its source code repositories on GitHub.
According to the advisory published by Dropbox, the company was the target of a phishing campaign that resulted in access to the GitHub repositories.
The investigation revealed that the code accessed by the attackers contained some credentials, primarily, API keys, used by the development team.
The company pointed out that no one’s content, passwords, or payment information were accessed, it also remarked that the issue was quickly resolved.
Dropbox uses CircleCI for select internal deployments, and in early October, a phishing campaign targeted multiple Dropboxers using messages impersonating CircleCI.
“While our systems automatically quarantined some of these emails, others landed in Dropboxers’ inboxes. These legitimate-looking emails directed employees to visit a fake CircleCI login page, enter their GitHub username and password, and then use their hardware authentication key to pass a One Time Password (OTP) to the malicious site.” reads the advisory published by the company. “This eventually succeeded, giving the threat actor access to one of our GitHub organizations where they proceeded to copy 130 of our code repositories.”
The repositories included internal copies of third-party libraries slightly modified for use by Dropbox, internal prototypes, and some tools and configuration files used by the security team of the file hosting service.
