GitHub repositories cloned with a compromised machine-account token
On December 6, 2022 an attacker used a compromised personal access token belonging to a GitHub machine account to clone repositories from GitHub's atom, desktop and other deprecated organizations. The repositories held encrypted code-signing certificates for GitHub Desktop and Atom. GitHub revoked the token on December 7, disclosed on January 30, 2023, and revoked the exposed certificates on February 2, 2023, which disabled some older Desktop for Mac and Atom builds.
- Victim
- GitHub
- Industry
- Technology
- Country
- United States
- Intrusion began
- Dec 6, 2022
- First disclosed
- Jan 30, 2023
- Actor
- Unattributed
- Initial access
- Stolen credentials
- Identity control that failed
- Non-human identity
- MFA
- Not applicable (no interactive login)
- Abused identity
- Non-human (service account, token, key or app)
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
A long-lived token on a machine account, with read access to repositories that held signing material, was enough. Short-lived, narrowly scoped workload credentials and keeping signing keys out of source control would have removed the payoff.
Go deeper on SWI
- Technique: Static API key abuse
Sources
- GitHub revokes stolen code signing certs, invalidates some versions of Atom and GitHub Desktop for Mac, DevClass, Jan 31, 2023
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Cloudflare Atlassian intrusion with credentials left unrotated after the Okta breach 2024 · Stolen credentials
- LastPass customer vault backup theft via engineer credentials and trusted device cookie 2022 · Stolen credentials
- GhostAction returns: hijacked GitHub accounts push secret-stealing workflows 2026 · Stolen credentials
- TeamViewer corporate IT intrusion via a compromised employee account 2024 · Stolen credentials
Cite this record
SWI Community Team. (2026). GitHub repositories cloned with a compromised machine-account token. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2023-github-machine-account-token-code-signing/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.