Grafana Labs Source Code Theft via Stolen GitHub Access Token — CoinbaseCartel Extortion Campaign
Grafana Labs Source Code Theft via Stolen GitHub Access (TL-2026-0527), also tracked as CoinbaseCartel Grafana Breach, is a high-severity data breach, first published 2026-05-18. It is attributed to CoinbaseCartel with medium confidence, affects Grafana Labs Grafana source code repositories (GitHub-hosted), maps to 18 MITRE ATT&CK techniques (T1048, T1071.001, T1078), and is covered by 9 detection rules and 18 indicators of compromise.
Key facts for TL-2026-0527
- Threat ID
- TL-2026-0527
- Also known as
- CoinbaseCartel Grafana Breach, Grafana GitHub Token Theft 2026, Grafana Source Code Leak
- Severity
- HIGH
- Status
- ACTIVE
- Category
- DATA_BREACH
- First published
- 2026-05-18
- Last reviewed
- 2026-05-18
- Attribution
- CoinbaseCartel
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- technology, software, saas, observability, devops
- Target regions
- North America, Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 18
Malware and tooling in Grafana Labs Source Code Theft via Stolen GitHub Access
Malware and tooling: Lumma Stealer - S1213, Rhadamanthys, Stealc, Vidar, shinysp1d3r, Data leak site (CoinbaseCartel portal)
Grafana Labs disclosed on May 18, 2026 that attackers used a stolen GitHub access token to download portions of its source code. The CoinbaseCartel extortion gang — composed of ShinyHunters and Lapsus$ affiliates — listed Grafana on its data leak site and demanded a ransom, which Grafana refused per FBI guidance. Grafana found no evidence of customer data or production system compromise.
How Grafana Labs Source Code Theft via Stolen GitHub Access works
On May 18, 2026, observability vendor Grafana Labs publicly disclosed that an unauthorized actor used a stolen GitHub access token to gain access to its GitHub environment and download proprietary source code. The disclosure followed the appearance of a Grafana entry on the data leak portal of the CoinbaseCartel extortion gang, which demanded payment in exchange for non-publication of the stolen codebase.
Grafana stated that its forensic investigation traced the breach to a single compromised access token, that customer-facing production systems were unaffected, and that there was no evidence of exposure of customer data or personal information. The company invalidated the compromised credentials, implemented additional hardening measures around its source repositories, and pledged a fuller post-incident write-up. Grafana followed FBI guidance and declined to pay the ransom.
CoinbaseCartel emerged in September 2025 and is publicly assessed by researchers to consist of affiliates aligned with the ShinyHunters and Lapsus$ ecosystems. The gang's standing tradecraft, observed across 100+ claimed victims, leans on social engineering (vishing of help desks, SSO-portal phishing kits), abuse of stolen OAuth and personal access tokens from developer endpoints (commonly via infostealer logs), and abuse of trusted SaaS integrations such as GitHub Apps, OAuth-bound CI runners, and Salesforce Data Loader. The gang has been linked by independent researcher Joe Shenouda to an in-memory ESXi encryptor dubbed 'shinysp1d3r' that targets VMware ESXi hypervisors and disables snapshots prior to encryption; ShinyHunters has publicly distanced itself from the CoinbaseCartel brand. The Grafana intrusion fits the broader pattern of GitHub-token-driven source-code extortion that has affected multiple high-profile SaaS vendors throughout 2025-2026.
The access vector for the Grafana breach — a long-lived GitHub PAT or fine-grained token leaked from a developer endpoint or third-party integration — is consistent with the gang's documented playbook of mining stealer logs (Lumma, Rhadamanthys, StealC, Vidar) for cookies, refresh tokens, and PAT strings, then exercising those tokens to enumerate organization-private repositories, archive them via the GitHub REST API (`/repos/{owner}/{repo}/zipball`), and exfiltrate the archives over HTTPS to attacker-controlled object storage. Because GitHub PATs and GitHub App installation tokens inherit a broad set of repo-, actions-, and packages-scoped privileges, a single leaked token is sufficient to enumerate and clone entire organizations without triggering interactive MFA. CoinbaseCartel's extortion-only posture — no ransomware deployed against the victim's own environment — distinguishes the Grafana incident from a shinysp1d3r-style ESXi attack and shifts the leverage entirely onto reputational and source-code-exposure risk.
Defensive priorities for Grafana customers and similarly exposed SaaS vendors include: enforcing fine-grained GitHub tokens with per-repo scopes and short TTLs, eliminating long-lived PATs in favor of OIDC-federated workload identity, requiring SSO + hardware-bound passkeys for all developer GitHub access, restricting repository archive downloads via GitHub audit policy and anomaly detection on `git.clone` / `git.fetch` volume, monitoring infostealer-log marketplaces for organization-scoped credentials, and exercising rapid token-rotation and repo lockdown playbooks. Source-code exposure of an observability platform raises secondary risk of secret leakage (embedded test credentials, signing keys, customer-tenant identifiers) and second-stage exploit development against unpatched code paths; downstream Grafana operators should prepare for an uptick in targeted exploit research against Grafana OSS and Grafana Enterprise.
MITRE ATT&CK techniques used in TL-2026-0527
Exfiltration
T1048 Exfiltration Over Alternative Protocol; T1567 Exfiltration Over Web Service; T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1102 Web Service
Initial Access
T1078 Valid Accounts; T1078.004 Valid Accounts: Cloud Accounts; T1199 Trusted Relationship; T1566 Phishing
Discovery
T1087.004 Account Discovery: Cloud Account; T1526 Cloud Service Discovery
Collection
T1213 Data from Information Repositories; T1213.003 Data from Information Repositories: Code Repositories
Credential Access
T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1555.003 Credentials from Password Stores: Credentials from Web Browsers
Resource Development
Impact
Affected products and versions in Grafana Labs Source Code Theft via Stolen GitHub Access
- Grafana Labs — Grafana source code repositories (GitHub-hosted)
Vulnerable versions: organization GitHub environment as of May 2026
Fixed in: post-remediation: tokens rotated, additional controls deployed - GitHub — GitHub Personal Access Tokens / GitHub Apps (abused as access vector)
Vulnerable versions: classic PATs without IP allowlist or SSO enforcement
Fixed in: fine-grained PATs with per-repo scopes + SSO enforcement
Remediation for Grafana Labs Source Code Theft via Stolen GitHub Access
Patches
- No vendor patch — this is a credential-abuse / process-control issue, not a software vulnerability
Immediate actions
- Rotate ALL GitHub personal access tokens (PATs), fine-grained tokens, and GitHub App installation tokens across the organization
- Audit GitHub organization audit log for the past 90 days for anomalous repo archive downloads (git.clone, repo.download_zip, repo.download_tarball events)
- Disable classic PATs at the organization level and require fine-grained tokens with per-repo scopes
- Force SSO re-authentication and revoke all active OAuth grants tied to GitHub
- Search infostealer-log marketplaces and dark-web brokers for tokens, cookies, and credentials referencing your organization domains
Workarounds
- Temporarily set repository visibility to private and restrict cloning to allowlisted IPs while token hygiene is verified
- Block GitHub PAT usage from residential and VPS ASNs at the egress proxy until fine-grained tokens are rolled out
Longer-term hardening
- Migrate CI/CD from long-lived GitHub PATs to OIDC-federated workload identity (GitHub Actions OIDC to AWS/GCP/Azure)
- Enforce passkeys (WebAuthn) for all GitHub accounts in privileged repos; deprecate TOTP
- Enable GitHub Advanced Security secret scanning + push protection on every repository
- Deploy EDR with browser-cookie and credential-store protection on all developer endpoints to neutralize infostealer harvesting
- Implement GitHub organization IP allowlist tied to corporate VPN or SASE egress
- Stand up a token-anomaly detection pipeline using GitHub audit log streamed to SIEM (clone volume, off-hours archive downloads, novel user-agents)
Weaknesses (CWE) in Grafana Labs Source Code Theft via Stolen GitHub Access
CWE-798, CWE-522, CWE-287, CWE-307, CWE-256
Timeline of Grafana Labs Source Code Theft via Stolen GitHub Access
- CoinbaseCartel extortion gang launches data leak portal; researchers attribute affiliates to ShinyHunters and Lapsus$ ecosystems.
- CoinbaseCartel passes 100+ claimed victims on its data leak site; gang publicly states it is 'behind on many leaks', implying additional undisclosed breaches.
- Estimated window for stolen GitHub access token to have been exercised against Grafana's GitHub organization (precise date subject to Grafana's forensic disclosure).
- Grafana invalidates the compromised access token and implements additional hardening measures around source repositories during weekend incident response.
- Grafana Labs appears on the CoinbaseCartel data leak portal; gang demands ransom in exchange for non-publication of stolen source code.
- Researcher Joe Shenouda publicly links CoinbaseCartel to an in-memory ESXi encryptor 'shinysp1d3r' that disables snapshots prior to encryption (not deployed against Grafana — extortion-only).
- ShinyHunters publicly clarifies it is not linked to CoinbaseCartel, despite researcher attribution of overlapping affiliates.
- Grafana Labs publicly discloses the breach, confirms source-code download via stolen GitHub token, states no customer data or production systems were affected, and declines to pay the ransom per FBI guidance.
- As of 2026-05-29, the threat remains ACTIVE: CoinbaseCartel is extorting at industrial cadence (~170 victims, multiple leaks/week, Panasonic Avionics newly listed alongside Grafana) with no takedown despite April 2026 arrests. The stolen GitHub-token source-code extortion TTP is the dominant 2026 web-attack pattern; no CVE/patch applies, only credential hygiene.
Sources cited for Grafana Labs Source Code Theft via Stolen GitHub Access
- Grafana says stolen GitHub token let hackers steal codebase
- Grafana Labs Security Incident Disclosure (May 2026)
- FBI IC3 Guidance — Do Not Pay Ransomware/Extortion Demands
- GitHub Docs — Managing your personal access tokens (fine-grained)
- GitHub Docs — Reviewing the audit log for your organization
- MITRE ATT&CK T1528 — Steal Application Access Token
- MITRE ATT&CK T1213.003 — Code Repositories
- CISA Alert AA24-241A — ShinyHunters/Lapsus$ ecosystem TTPs (background)
Threats related to Grafana Labs Source Code Theft via Stolen GitHub Access
- Vercel April 2026 Security Incident — Context.ai OAuth Compromise Leads to Google Workspace Takeover and Customer Environment Variable Exposure
- Dark Web Identity-Theft Ecosystem: $0.95 Fullz, STORM Infostealer-as-a-Service, and Scam-as-a-Service Marketplaces
- Azure Credential Theft Campaign Exposes Millions of Enterprise Records at McDonald's, Vodafone, TCS
- "TheHatman" Azure/Entra Directory Exfiltration Campaign Exposes Millions of Employee Records at McDonald's, Vodafone, Kyndryl, TCS, HCL and Others
- Alleged Żabka Polska Breach: 541K Jira Issues, 230K IT Tickets, 89 GitLab Repos, and Cloudflare/MongoDB/Broker Credentials Offered for €5,000
- Microsoft Maps Year-Long ShinyHunters-Linked Salesforce Data Theft Across Three Attack Paths (UNC6040/UNC6240/UNC6395/GRUB1/Storm-3138)
Detection coverage for TL-2026-0527
As of 2026-05-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0527 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.