How to Investigate GitHub PAT Compromise: Lessons From a Multi-Organization Campaign

A coordinated campaign leveraging compromised GitHub Personal Access Tokens enabled attackers to conduct mass repository exfiltration across multiple organizations, exposing sensitive secrets and credentials, with the initial access vector remaining undetermined and highlighting the critical need for unified audit log visibility and rapid credential rotation.