CircleCI Breach: Stolen Session Cookies and Your CI Secrets

CI platforms hold the most valuable thing in your delivery chain: credentials that can deploy to production. In December 2022, CircleCI learned what happens when the platform itself is the target. The incident is still the best case study for why a “rotate everything” notice is a business-continuity event, and for why long-lived secrets in CI settings are a liability you can design away.

What happened

According to CircleCI’s own incident report, malware was deployed to a single engineer’s laptop on December 16, 2022. It evaded their commercial antivirus and stole a session cookie for an SSO session that had already passed two-factor authentication. The attacker impersonated the engineer, reached a subset of production systems, and between December 22 and 29 exfiltrated data from databases and stores.

That engineer had access to generate production tokens as part of their normal duties. That is the root cause in one sentence: a replayable bearer token for an authenticated session was enough, and the session carried broad production reach.

CircleCI disclosed on January 4, 2023 and told every customer to rotate every secret stored in the platform. Customer environment variables, contexts, and tokens were taken. The data was encrypted at rest, but the attacker also extracted encryption keys from running processes, so CircleCI told customers to assume the secrets were exposed.

Why MFA did not help

Two-factor authentication protects the login. A session cookie is what the login produces, and it is replayable from anywhere until it expires or is revoked. Infostealer malware targets exactly that: browser cookie stores, not passwords. The attacker never defeated MFA; they inherited its result.

Defenses that address this:

• Device-bound sessions and conditional access. Require a managed, compliant device and re-evaluate on IP or device change, so a cookie lifted to another machine is rejected.
• Short session lifetimes for privileged roles, with step-up authentication for production-touching actions.
• Phishing-resistant MFA plus token binding where your IdP supports it. My piece on Snowflake and phishing-resistant MFA covers the limits of MFA alone.
• No standing access to key material. Engineers should not be able to mint production tokens from an ordinary workstation session.

Blast radius for a CI customer

If you were a customer, your exposure was whatever you had stored in CircleCI: cloud access keys, registry tokens, deploy keys, SSH keys, and third-party API tokens. Many teams spent days hunting every place a secret lived, because nobody had an inventory.

The painful part was not rotation itself. It was discovering that the same long-lived AWS access key sat in four projects, two contexts, and a script someone forgot.

Remediation: make rotation boring

1. Replace stored cloud keys with OIDC federation. CI jobs exchange a short-lived identity token for temporary credentials, so there is nothing durable to steal. I covered the AWS side in GitHub Actions OIDC to AWS and the GitLab and CircleCI variant.
2. Scope trust tightly. Pin the role’s trust policy to the specific org, project, and branch claims. A wildcard sub turns federation into an open door.
3. Keep a secrets inventory. Know which secret lives where and who owns it. If you cannot list them in an hour, you cannot rotate them in a day.
4. Pull secrets at run time from a manager (Secrets Manager, Vault) using the job’s federated identity, instead of storing values in CI settings.
5. Detect misuse. Alert on CloudTrail activity from CI-assumed roles outside expected IP ranges, and on any use of long-lived keys that should be dormant. Check AccessKeyLastUsed after any provider incident.
6. Put the vendor in your threat model. Keep a tested runbook: revoke tokens, rotate keys, audit logs from the exposure window, and rebuild trust.

The takeaway

The attacker did not break cryptography or exploit a CVE. They stole a cookie from one laptop and reached a system holding thousands of companies’ deployment credentials. You cannot prevent a vendor’s endpoint compromise, but you can decide whether their breach hands over durable keys or a pile of expired, narrowly scoped tokens. Federate, scope, inventory, and rehearse the rotation before you need it.