Dropbox, a file hosting service giant headquartered in San Francisco, California, disclosed a phishing incident on November 1, 2022, where the threat actor responsible accessed and exfiltrated 130 GitHub repositories. Dropbox utilizes GitHub to host their public repositories as well as a portion of their private repositories. In their statement, Dropbox explained that multiple employees of Dropbox received phishing emails that prompted the user to “visit a fake CircleCI login page, enter their GitHub username and password, and use their hardware authentication key to pass a One Time Password (OTP) to the malicious site.” Dropbox confirmed that on October 14, 2022, GitHub alerted of suspicious activity that began the day before. Dropbox immediately investigated the activity and determined that the threat actor impersonating CircleCI accessed one (1) of Dropbox’s GitHub accounts where they copied 130 code repositories. This tactic was recently detailed by GitHub in September 2022, when threat actors were targeting GitHub users in various organizations via a phishing campaign disguising as CircleCI to harvest user credentials and two-factor authentication (2FA) codes. Dropbox confirmed that the threat actor at no point had access to Dropbox account content, passwords, or payment information during the security incident, but did state that the code accessed contained some credentials (primarily API keys) used by Dropbox developers. The code also included a “few thousand names and email addresses belonging to Dropbox employees, current and past customers, sales leads, and vendors.” DropBox noted that it has more than 700 million registered users and there is currently no evidence of successful abuse. CTIX analysts will continue to monitor Dropbox’s phishing incident as well as report on additional organizations that fall victim to the previously seen CircleCI impersonation tactic.