Ransomware/Malware Activity
Dropbox Discloses Phishing Incident Caused by CircleCI
Impersonation
Dropbox, a file hosting service giant headquartered in San
Francisco, California, disclosed a phishing incident on November 1,
2022, where the threat actor responsible accessed and exfiltrated
130 GitHub repositories. Dropbox utilizes GitHub to host their
public repositories as well as a portion of their private
repositories. In their statement, Dropbox explained that multiple
employees of Dropbox received phishing emails that prompted the
user to "visit a fake CircleCI login page, enter their GitHub
username and password, and use their hardware authentication key to
pass a One Time Password (OTP) to the malicious site." Dropbox
confirmed that on October 14, 2022, GitHub alerted of suspicious
activity that began the day before. Dropbox immediately
investigated the activity and determined that the threat actor
impersonating CircleCI accessed one (1) of Dropbox's
