Dropbox GitHub repositories stolen via CircleCI-themed phishing
In early October 2022 Dropbox employees received phishing emails impersonating CircleCI that led to a fake login page, where staff entered GitHub credentials and passed one-time passwords from their hardware keys to the site. The attacker used this access to copy 130 code repositories from one of Dropbox's GitHub organizations; GitHub alerted Dropbox on October 14 and Dropbox disclosed on November 1, 2022.
- Victim
- Dropbox
- Industry
- Technology
- Country
- United States
- Intrusion began
- Oct 2022
- First disclosed
- Nov 1, 2022
- Actor
- Unattributed
- Initial access
- Phishing (adversary-in-the-middle)
- Identity control that failed
- Authentication
- MFA
- Present and bypassed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
OTP from a hardware token is still phishable; WebAuthn security keys bind the login to the real origin, and Dropbox moved its environment to them.
Go deeper on SWI
- Technique: Attacker-in-the-middle phishing proxy
Sources
- How we handled a recent phishing incident that targeted Dropbox, Dropbox, Nov 1, 2022
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Stolen Microsoft 365 session tokens replayed into 79 organizations 2026 · Phishing (adversary-in-the-middle)
- AiTM phishing campaign against more than 10,000 Microsoft 365 organizations 2022 · Phishing (adversary-in-the-middle)
- N-able N-central authentication bypass used to reach managed customer networks 2026 · Identity infrastructure vulnerability
- SimpleHelp RMM OIDC token forgery exploited for technician access 2026 · Identity infrastructure vulnerability
Cite this record
SWI Community Team. (2026). Dropbox GitHub repositories stolen via CircleCI-themed phishing. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2022-dropbox-github-phishing/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.