Grafana Labs Source Code Theft via Stolen GitHub Access Token — CoinbaseCartel Extortion Campaign — Threadlinqs Intelligence
As of 2026-05-30, Grafana Labs Source Code Theft via Stolen GitHub Access Token — CoinbaseCartel Extortion Campaign is a high-severity data breach threat attributed to CoinbaseCartel, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 18 indicators of compromise.
Threat ID: TL-2026-0527 · Severity: HIGH · Status: ACTIVE · Category: DATA_BREACH
Attribution: CoinbaseCartel · FINANCIAL
Grafana Labs disclosed on May 18, 2026 that attackers used a stolen GitHub access token to download portions of its source code. The CoinbaseCartel extortion gang — composed of ShinyHunters and
On May 18, 2026, observability vendor Grafana Labs publicly disclosed that an unauthorized actor used a stolen GitHub access token to gain access to its GitHub environment and download proprietary source code. The disclosure followed the appearance of a Grafana entry on the data leak portal of the CoinbaseCartel extortion gang, which demanded payment in exchange for non-publication of the stolen codebase.
Grafana stated that its forensic investigation traced the breach to a single compromised access token, that customer-facing production systems were unaffected, and that there was no evidence of exposure of customer data or personal information. The company invalidated the compromised credentials, implemented additional hardening measures around its source repositories, and pledged a fuller post-incident write-up. Grafana followed FBI guidance and declined to pay the ransom.
CoinbaseCartel emerged in September 2025 and is publicly assessed by researchers to consist of affiliates aligned with the ShinyHunters and Lapsus$ ecosystems. The gang's standing tradecraft, observed across 100+ claimed victims, leans on social engineering (vishing of help desks, SSO-portal phishing kits), abuse of stolen OAuth and personal access tokens from developer endpoints (commonly via infostealer logs), and abuse of trusted SaaS integrations such as GitHub Apps, OAuth-bound CI runners, and Salesforce Data Loader. The gang has been linked by independent researcher Joe Shenouda to an in-memory ESXi encryptor dubbed 'shinysp1d3r' that targets VMware ESXi hypervisors and disables snapshots prior to encryption; ShinyHunters has publicly distanced itself from the CoinbaseCartel brand. The Grafana intrusion fits the broader pattern of GitHub-token-driven source-code extortion that has affected multiple high-profile SaaS vendors throughout 2025-2026.
The access vector for the Grafana breach — a long-lived GitHub PAT or fine-grained token leaked from a developer endpoint or third-party integration — is consistent with the gang's documented playbook of mining stealer logs (Lumma, Rhadamanthys, StealC, Vidar) for cookies, refresh tokens, and PAT strings, then exercising those tokens to enumerate organization-private repositories, archive them via the GitHub REST API (`/repos/{owner}/{repo}/zipball`), and exfiltrate the archives over HTTPS to attacker-controlled object storage. Because GitHub PATs and GitHub App installation tokens inherit a broad set of repo-, actions-, and packages-scoped privileges, a single leaked token is sufficient to enumerate and clone entire organizations without triggering interactive MFA. CoinbaseCartel's extortion-only posture — no ransomware deployed against the victim's own environment — distinguishes the Grafana incident from a shinysp1d3r-style ESXi attack and shifts the leverage entirely onto reputational and source-code-exposure risk.
Defensive priorities for Grafana customers and similarly exposed SaaS vendors include: enforcing fine-grained GitHub tokens with per-repo scopes and short TTLs, eliminating long-lived PATs in favor of OIDC-federated workload identity, requiring SSO + hardware-bound passkeys for all developer GitHub access, restricting repository archive downloads via GitHub audit policy and anomaly detection on `git.clone` / `git.fetch` volume, monitoring infostealer-log marketplaces for organization-scoped credentials, and exercising rapid token-rotation and repo lockdown playbooks. Source-code exposure of an observability platform raises secondary risk of secret leakage (embedded test credentials, signing keys, customer-tenant identifiers) and second-stage exploit development against unpatched code paths; downstream Grafana operators should prepare for an uptick in targeted exploit research against Grafana OSS and Grafana Enterprise.
Weaknesses (CWE)
CWE-798, CWE-522, CWE-287, CWE-307, CWE-256
Target sectors: technology, software, saas, observability, devops
Target regions: North America, Europe, Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 18 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
DATA_BREACH, HIGH, threat intelligence, cybersecurity, T1650, T1078, T1078.004, T1199, T1566, T1528, T1555.003, T1539, T1526, T1087.004