Threat Intelligence Brief
Curated summary with source attribution
Source: govinfosecurity.com
Threat Risk: High
Victim: Novo Nordisk
Incident: A massive data breach caused by the exploitation of hardcoded GitHub and Azure DevOps access tokens.
Impact: Exfiltration and public leak of over one terabyte of sensitive corporate data.
Attacker: FulcrumSec
Analysis: The attackers exploited hardcoded Personal Access Tokens (PATs) discovered in client-side JavaScript on public-facing subdomains. These tokens granted initial access to Azure DevOps and GitHub, allowing the group to harvest additional secrets and move laterally into AWS and Hugging Face environments. This incident underscores the critical risk of exposing developer credentials in production code.
Recommendations: Implement automated secrets scanning in CI/CD pipelines to prevent hardcoded credentials from reaching production.; Audit all public-facing JavaScript bundles and client-side code for exposed API keys or access tokens.; Enforce the principle of least privilege for Personal Access Tokens and migrate to short-lived, scoped credentials.
Source: GovInfoSecurity
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source