GoKawiilReport: Attackers now exfiltrate data within 15 minutes of breach, bypassing standard tools
A security analysis describes three attack patterns—stolen GitHub developer tokens, ClickFix lures disguised as Claude Code install commands, and help-desk vishing that tricks employees into approving MFA prompts—that let intruders access and extract data within about 15 minutes of gaining entry. The report found that existing detection tools, including GitHub's native monitoring and identity providers, failed to flag these techniques as malicious. One example cited involved a GitHub Desktop OAuth token left dormant for 95 days before being used by an attacker.