GitHub PATs are now a bulk exfiltration tool, and most teams cannot audit the aftermath

Wiz's Customer Incident Response Team says it investigated a coordinated campaign in which compromised GitHub Personal Access Tokens were used for repository reconnaissance and mass repository exfiltration across multiple organizations ^[1], active from mid-May through early June 2026 and moving through reconnaissance, access validation, large-scale cloning, and follow-on attempts to use the credentials it stole ^[2]. What should worry operators is not the theft but the response path: for most victims the first visible sign was a spike in git.clone events on a single day ^[3], and containment depends on a token type that organization owners frequently cannot see at all ^[12].

According to Wiz, between 09:14 and 14:55 UTC on June 1 the actor operated from 102 AWS IP addresses in the ca-central-1 region ^[4], cloning up to thousands of repositories per organization ^[5]. That is a working window of about five hours and forty minutes ^[6]. The traffic carried the git/2.43.0 user agent and was highly parallelized, which Wiz reads as automated tooling ^[7]. The clones were performed with valid PATs belonging to employees of the affected organizations ^[8], so in GitHub's terms nothing was unauthorized; the tokens did what tokens do. They are worth stealing because one of them can open private repositories and the secrets inside them, including cloud credentials, API keys, and private keys that carry the compromise past GitHub ^[9].

Revocation is where capability diverges by token type. Organization owners can view and revoke individual fine-grained PATs holding access to organization resources, but revoking organization access does not necessarily delete the underlying token ^[10]. Where SAML SSO is enforced, owners can see classic PATs authorized against the organization and pull that SSO authorization, which removes access to SSO-protected resources and again leaves the token alive ^[11]. Without SAML SSO, organization and enterprise owners generally have no visibility into or control over individual classic PATs: the affected user has to delete it, or responders must revoke it through GitHub's REST API, which requires knowing the actual token value ^[12]. Enterprise Managed Users lets an enterprise centrally delete a user's tokens and other credentials ^[13], and Wiz says EMU is less commonly deployed across the GitHub environments it sees ^[14]. The cleanest containment story belongs to the configuration fewest teams run.

Because owners often cannot independently verify that a revocation took effect, or rule out other compromised tokens tied to the same user, Wiz recommends temporarily removing the user from the organization while the investigation continues ^[15], and treating a stolen PAT as possible evidence of endpoint or credential-store compromise, which means restricting that user's access to other sensitive systems and isolating suspect endpoints ^[16].

The reconstruction is the part most teams are not equipped for. Wiz's method is to baseline the user's normal behaviour from GitHub audit logs, including typical source IPs, geolocations, user agents, access times, and repository activity, then measure the token's activity against it ^[17]. It also requires the user's personal GitHub security log, which can hold personal-account events that never appear in the organization audit log ^[18]; under EMU, the equivalent user-level events sit in the enterprise audit log instead ^[19]. If your responders have never pulled either, the June 1 pattern is one you would notice only as unexplained clone volume.

Two things to watch. First, the follow-on stage: the campaign already included attempts to use exfiltrated credentials ^[2], so repositories cloned in May and June are a pipeline into cloud accounts, not an endpoint. Second, access to detail: Wiz says campaign specifics and indicators of compromise are in a Threat Intel Center advisory available to its customers ^[20], so everyone else is hunting on the behaviour described publicly.