Poisoned Pipeline / Incidents / AS193
Multi-org GitHub PAT campaign mass-cloned repositories
Git / GitHubDeveloper workstation
Wiz CIRT (13 Aug 2026): mid-May to early June 2026 campaign used
stolen employee GitHub PATs to recon and mass-clone private repos
across multiple organizations. Peak 1 June 09:14–14:55 UTC: 102 AWS
IPs in ca-central-1, git/2.43.0 user-agent, thousands of clones per
org. Follow-on attempts to use secrets found in those repos.
Mapped techniques
supply-chain stolen pat cloning
Stolen employee PATs used as valid git credentials.
Mass git.clone of private organization repositories.