How we handled a recent phishing incident that targeted Dropbox

A GitHub account was briefly taken over via a phishing attack

Dropbox has disclosed a phishing incident that briefly gave an attacker access to one of its GitHub organizations. The campaign, which began in October 2022, impersonated CircleCI and ultimately led to the copying of 130 code repositories. Dropbox emphasized that the attacker never reached customer content, passwords, or payment data, and that core apps and infrastructure remained unaffected.

The company said it believes the risk to customers is minimal, but has notified individuals whose information was exposed. That includes a few thousand names and email addresses belonging to Dropbox employees, customers, sales leads, and vendors. For context, Dropbox reports more than 700 million registered users.

How the attack unfolded

Dropbox uses GitHub for public and private repositories and relies on CircleCI for select internal deployments. In early October, several employees received phishing emails pretending to be from CircleCI. Since GitHub credentials can be used to log into CircleCI, the lure was built around that crossover.

Some emails were automatically quarantined, but others reached inboxes. The messages directed employees to a fake CircleCI login page, where they were asked to enter GitHub credentials and then pass a One Time Password (OTP) from a hardware authentication key to the malicious site. That step succeeded for at least one person, granting the attacker access to a GitHub organization.

Once inside, the attacker copied 130 repositories. Dropbox stated that the copied code did not include the repositories used for its core apps or infrastructure, which are subject to stricter access controls. The exposed repositories contained in-house copies of third-party libraries, internal prototypes, and some security team tools and configuration files.

Response and remediation

GitHub alerted Dropbox to suspicious behavior on October 14, 2022, with activity beginning the previous day. The attacker’s access was disabled the same day Dropbox learned of it. Security teams rotated all exposed developer credentials and reviewed logs, finding no evidence of successful abuse. Dropbox also brought in outside forensic experts to verify its findings and reported the event to regulators and law enforcement.

Looking ahead, Dropbox says it is accelerating its adoption of WebAuthn. The company notes that many organizations still rely on OTP and TOTP-based multi-factor authentication, which are more susceptible to phishing than hardware-backed WebAuthn. Dropbox was already moving toward WebAuthn before this incident and says the whole environment will soon be secured with hardware tokens or biometric factors. WebAuthn is also available to Dropbox customers as a sign-in option.

Dropbox acknowledged that humans cannot reliably spot every phishing lure, particularly when messages are well-crafted and timed correctly. That, the company said, makes technical controls the best defense and the reason it is pushing forward with more phishing-resistant authentication.

Users who notice suspicious activity on their Dropbox account can report it via the company’s abuse reporting channel.