Machine-speed attacks can begin data theft within 15 minutes

Attackers can start searching an environment or pulling data within 15 minutes of gaining access, according to an analysis by Exaforce, whose security platform and MDR analysts examined three attack patterns. The company says the cases show why detection based on data and behavior matters.

In one case, a developer’s GitHub OAuth token remained in a Mac keychain for 95 days after GitHub Desktop was used. On June 19, another party used the token to pull 76 repositories in about 15 seconds through residential proxies in more than two dozen European cities. Exaforce says its platform flagged the activity within five minutes and analysts confirmed the data theft, but the attacker had already taken data from 472 of the 638 repositories by the time action was taken. Exaforce says GitHub did not alert on the token’s use.

The analysis also describes malicious AI installer lures and voice phishing that tricks employees into approving real MFA prompts. In one case, attackers began a bulk download 2.5 to 7 minutes after approval and exfiltrated 140,000 files, then demanded a ransom, Exaforce says. In another, the company says it linked Okta and Microsoft sign-ins using account history after a stolen token was replayed from two other countries within one second.

Exaforce argues that organizations need behavioral detection and automated containment to respond at the speed of these attacks. The examples and conclusions are the company’s account of incidents it says it handled.