Cybersecurity analysts have observed that attackers are increasingly capable of enumerating and exfiltrating sensitive data within 15 minutes of gaining initial access to a corporate environment, as first reported by Bleeping Computer.
The research highlights three primary attack vectors: stolen developer tokens, ClickFix lures targeting AI tools and help desk vishing. In one instance, a stolen GitHub OAuth token remained dormant for 95 days before being used to exfiltrate data from 472 repositories in seconds. Because standard identity provider detections often fail to identify misuse when legitimate multi-factor authentication is approved, organizations are urged to implement autonomous response strategies.
Attackers frequently bypass security controls by leveraging social engineering to compromise sessions or by deploying infostealers that harvest browser cookies and cloud credentials. Industry experts emphasize that relying solely on manual intervention is insufficient, as data theft often continues even after initial account access is revoked. Effective mitigation requires automated, low-friction response actions across critical services including Google Workspace, Microsoft Entra ID and GitHub. By automating the revocation of sessions and credentials, security teams can better contain identity-based attacks before significant data loss occurs.
Source: Bleeping Computer
