Wiz CIRT traced a mid-May-through-early-June 2026 campaign that used stolen GitHub personal access tokens to enumerate, clone, and exfiltrate private repositories across multiple organizations, then tried to reuse harvested secrets for follow-on compromise.
The tokens worked because GitHub treated them as valid user credentials, so the actor could browse and clone private code like an authorized employee rather than break into each repo separately. That matters because source trees often hold cloud credentials, API keys, and private keys, turning repo theft into a path to other systems once those secrets are found.
For any org that stores secrets in GitHub, the blast radius is larger than the repository list. Cutting off the token stops one door, but it does not undo any credentials already copied out of the codebase or their downstream access elsewhere.