How we handled a recent phishing incident that targeted Dropbox

This post details a specific phishing incident where threat actors impersonated CircleCI to gain access to Dropbox's GitHub accounts. The incident resulted in the exfiltration of 130 code repositories containing developer credentials (API keys) and employee/customer/vendor PII. The response involved disabling access, rotating credentials, and engaging external forensic experts. The post highlights the adoption of WebAuthn as a key technical control to prevent similar future incidents, emphasizing its phishing-resistant nature compared to OTP/TOTP.