This is a similar timeline for the Drift (Salesloft) hack. I wonder if this was the strategy that was used to gain access to Saleslofts Github since the image on the article shows they were scanning for Creds.