Poisoned Pipeline / Incidents / AS14
CircleCI December 2022 / January 2023 incident
CI/CD SaaSCircleCIDeveloper workstation
CircleCI disclosed that an attacker used malware on a CircleCI employee's
laptop, bypassed 2FA, and accessed production systems. Session cookies and
customer secrets stored in CircleCI (environment variables, contexts)
were at risk; customers were told to rotate all secrets. The technique set already
had T0165 (Create access token) written against this incident; the story
itself was never added.
Mapped techniques
- T0153 Compromised developer workstation
- T0112 Compromised token
- T0165 Create access token
- T0130 Harvest secrets from logs
- T0199 Secret leak
- T0201 Customers compromised
supply-chain CircleCI
Malware on an employee workstation was the reported initial access.
Session cookies / tokens were reused to access production despite 2FA.
After a 2FA-backed session was obtained, durable access tokens
could be minted — the exact pattern T0165 describes.
Customer CI secrets held by the platform were in the blast radius.
post-supply-chain CircleCI customers
Customers had to assume project secrets, context variables, and
OIDC-adjacent credentials were exposed and rotate them.
Anyone who did not rotate in time faced follow-on use of their
cloud and source-control credentials.