When 15 Seconds Is All It Takes: Machine Speed Attacks Demand Autonomous Response
Executive Summary
In 2026, Exaforce documented a surge of sub-15-minute identity-driven attacks across enterprise environments. Three distinct patterns emerged: dormant OAuth tokens stolen from developer laptops via poisoned npm packages or infostealers were later weaponized to exfiltrate GitHub repositories at machine speed; ClickFix lures impersonating AI tool installers (Claude Code) deployed macOS stealers that harvested browser cookies and cloud credentials; and vishing campaigns mimicking IT help desks manipulated employees into approving real MFA prompts, granting attackers full session access within minutes. In one GitHub token case, 472 of 638 repositories were exfiltrated in under 15 seconds before containment actions could be authorized.
These incidents expose a structural gap in enterprise security: detection platforms and identity providers flag anomalies but rely on human approval for response actions, leaving a critical window attackers now routinely exploit. The convergence of AI-lure social engineering, long-lived OAuth tokens, and incomplete session revocation across SaaS ecosystems signals a new normal where autonomous, low-friction response automation is no longer optional.
Why This Matters Now
Attackers are completing full data exfiltration cycles in under 15 minutes—faster than most human-in-the-loop SOC workflows can authorize a response. With AI tool adoption expanding developer credential surfaces, dormant OAuth tokens proliferating across GitHub and cloud platforms, and identity providers failing to detect MFA-approved session hijacks, enterprises face an urgent gap between detection latency and breach velocity that only autonomous response can close.
Attack Path Analysis
Attackers used three converging vectors — poisoned npm packages extracting GitHub OAuth tokens, ClickFix lures delivering macOS infostealers, and vishing-driven MFA approval — to silently harvest long-lived credentials from developer endpoints and SaaS identity layers. Once valid tokens and session cookies were obtained, attackers moved directly to high-value data repositories and cloud services, exfiltrating hundreds of repositories and hundreds of thousands of files within minutes through residential proxies, exploiting the absence of token-level anomaly detection, inadequate egress controls, and incomplete cross-platform session revocation capabilities.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attackers used three simultaneous vectors: (1) poisoned npm packages and infostealers (e.g., Shai-Hulud worm) swept developer laptops for GitHub OAuth tokens (gho_ prefix) and cloud credentials stored in macOS keychains; (2) ClickFix lures embedded in shared Claude conversations delivered a macOS stealer via a single install command, bypassing email filters and download controls since the victim executed the command willingly; (3) vishing calls impersonating IT help desk directed victims to adversary-in-the-middle (AiTM) phishing pages, capturing credentials and manipulating victims into approving real MFA prompts. In all cases, initial access was achieved through valid, stolen credentials rather than vulnerability exploitation.
MITRE ATT&CK® Techniques
Steal Application Access Token
Compromise Software Supply Chain
Phishing: Spearphishing via Service
Steal Web Session Cookie
Multi-Factor Authentication Request Generation
Adversary-in-the-Middle
Data from Cloud Storage
Exfiltration Over Web Service: Exfiltration to Code Repository
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev. 5 – Remote Access Controls, Authenticator Management, and System Monitoring
Control ID: AC-17, IA-5, SI-4
PCI DSS 4.0 – Strong Authentication, Application and System Accounts Management, and Failure Detection
Control ID: Requirement 8.3, Requirement 8.6, Requirement 10.7
NYDFS 23 NYCRR 500 – Multi-Factor Authentication, Training and Monitoring, and Incident Response
Control ID: Section 500.12, Section 500.14, Section 500.16
DORA (EU) 2022/2554 – ICT Security Policies, ICT-Related Incident Detection, and ICT-Related Incident Reporting
Control ID: Article 9, Article 10, Article 17
NIS2 Directive (EU) 2022/2555 – Risk Management Measures, Incident Handling, and Supply Chain Security
Control ID: Article 21(2)(a), Article 21(2)(b), Article 21(2)(e)
CISA Zero Trust Maturity Model 2.0 – Continuous Identity Validation and Data Access Governance
Control ID: Identity Pillar: Advanced/Optimal Stage, Data Pillar: Traditional/Advanced Stage
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Developer OAuth tokens stolen via poisoned npm packages and ClickFix lures expose source code repositories to machine-speed exfiltration, bypassing GitHub's native detections and NIST.800-53.SC-7 egress controls.
Information Technology/IT
Vishing-based help desk impersonation and AiTM session hijacking compromise SSO pipelines across AWS, Okta, and Entra ID, demanding autonomous anomaly detection and zero-trust segmentation per ZTMM.Network compliance.
Financial Services
Infostealer credential theft targeting cloud and SaaS platforms risks PCI.4.0 and NIST.CSF.PR.DS-5 violations, enabling rapid bulk data exfiltration within 15 minutes of initial identity compromise.
Health Care / Life Sciences
Stolen session tokens and MFA bypass techniques threaten HIPAA.164.312(e)(1) data-in-transit protections, exposing patient records across cloud productivity suites like Google Workspace and Microsoft 365.
Sources
- Machine speed attacks require machine speed detection and responsehttps://www.bleepingcomputer.com/news/security/machine-speed-attacks-require-machine-speed-detection-and-response/Verified
- CISA Advisory AA23-320A: Scattered Spiderhttps://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320aVerified
- GitHub Documentation: Managing OAuth App Access Restrictionshttps://docs.github.com/en/organizations/managing-oauth-access-to-your-organizations-data/about-oauth-app-access-restrictionsVerified
- Exaforce Blog: Detecting GitHub Token Compromisehttps://www.exaforce.com/blogs/detect-github-compromiseVerified
- Exaforce Blog: ClickFix Infostealer Analysis and Indicatorshttps://www.exaforce.com/blogs/exafiles-introducing-infosastealer-clickfix-delivery-fake-system-dialogs-and-the-quiet-trojanization-of-hardware-wallet-softwareVerified
- Exaforce Blog: Adversary-in-the-Middle Custom Infrastructure Case Studyhttps://www.exaforce.com/blogs/no-off-the-shelf-kit-required-a-case-study-in-custom-built-adversary-in-the-middle-infrastructureVerified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- Okta Universal Logout Documentationhttps://developer.okta.com/docs/guides/logout/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to this incident because attackers relied on unrestricted lateral movement across federated cloud services and uncontrolled egress paths to exfiltrate data at scale. By enforcing workload-level segmentation and identity-aware egress controls, the blast radius of stolen credentials reaching downstream cloud environments like AWS, Snowflake, and GitHub would likely be meaningfully reduced.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Consistent application of cloud-native security fabric policies could limit the reachability of developer endpoints to sensitive cloud workloads, reducing the scope of what stolen credentials could immediately access once harvested from compromised machines.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation could reduce the privilege scope available to replayed tokens by enforcing workload-level access boundaries, meaning that a stolen long-lived token may still be unable to traverse into cloud infrastructure segments it was never explicitly authorized to reach.
Control: East-West Traffic Security
Mitigation: East-west traffic security controls would likely constrain lateral traversal between cloud services by requiring explicit policy authorization for workload-to-workload communication, reducing how freely a replayed session token could pivot across GitHub, Snowflake, and AWS environments.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility and control could surface anomalous outbound communication patterns — such as bulk API calls through residential proxy egress paths — that would likely constrain the attacker's ability to operate undetected across cloud environments for extended periods.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security and policy enforcement would likely constrain the volume and velocity of outbound data leaving cloud environments by applying rate-aware or destination-aware egress controls, reducing how much data could be pulled through API-based bulk download methods before policy thresholds are triggered.
Had prior segmentation and egress controls constrained lateral movement and outbound data paths, the residual impact would likely be limited to the initially compromised service segment rather than spanning hundreds of repositories, multiple cloud platforms, and persistent email interception channels.
Impact at a Glance
Affected Business Functions
- Source Code Repository and Intellectual Property Management
- Cloud Identity and Access Management (IAM)
- Software Development and CI/CD Pipeline Integrity
- Enterprise SaaS Productivity and Collaboration Services
Estimated downtime: 1 days
Estimated loss: N/A
Confirmed exfiltration of source code from up to 472 of 638 GitHub repositories within approximately 15 seconds of token use, representing potentially millions of lines of proprietary code, embedded secrets, API keys, and infrastructure configurations. In vishing-related incidents, 140,000 files were exfiltrated before ransom demand was issued, covering corporate documents, credentials, and possibly regulated business data. Browser cookies, cloud credentials, macOS keychain contents, and saved passwords were stolen via ClickFix infostealer deployments, exposing access to cloud platforms including AWS, GCP, Azure, Snowflake, and AI service providers. Cross-platform session token theft enabled continued data exfiltration for 44 minutes to 3 hours after initial identity provider session revocation, confirming persistent unauthorized access across productivity and cloud environments.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Egress Security & Policy Enforcement (CNSF): Implement FQDN-based egress filtering and outbound traffic policy enforcement to detect and block anomalous bulk API calls to GitHub, Snowflake, AWS STS, and AI model providers — particularly high-volume ZIP archive downloads routed through residential proxies or unfamiliar geographic egress points, directly countering the exfiltration patterns observed across all three attack vectors.
- • Enforce Zero Trust Segmentation for SaaS and Cloud API Access: Apply identity-based microsegmentation policies that restrict OAuth token usage to known device postures, user geographies, and behavioral baselines; ensure that long-lived non-expiring tokens (e.g., GitHub gho_ tokens) are subject to continuous posture validation and automatic revocation triggers when anomalous access patterns are detected — addressing the privilege persistence gap exploited post-IdP session revocation.
- • Activate Multicloud Visibility & Control for Cross-Platform Session Correlation: Deploy centralized traffic observability and control plane analytics across Okta, Microsoft Entra ID, GitHub, AWS, and Snowflake to correlate sign-in events, token replay, and session anomalies in real time; the observed token replay from multiple countries within one second and first-ever account sign-ins from new geographies and device types should trigger automated high-confidence alerts with autonomous low-friction response actions.
- • Enable East-West Traffic Security Between Cloud and SaaS Workloads: Monitor and enforce policy on service-to-service and workload-to-workload flows between federated identity systems and downstream cloud services; SSO-derived AWS and Snowflake sessions that persist independently of IdP revocation represent unmonitored east-west trust paths that require inline inspection and session invalidation capabilities aligned with ZTMM.Network controls.
- • Leverage Cloud Native Security Fabric (CNSF) for Autonomous Response at Machine Speed: Given that attackers completed bulk exfiltration within 15 seconds to 7 minutes of gaining access, implement agentic autonomous response capabilities that can execute pre-built low-friction revocation actions — including OAuth token deletion, MFA method removal, and STS session denial via inline policy — across all critical services (GitHub, Snowflake, AWS, Anthropic, Google Workspace) without requiring human approval latency, prioritizing services holding source code, credentials, and AI model access.
