---
title: "Developers Targeted in GitHub OAuth Phishing Campaign"
date: 2026-04-21
author: "Sofia Ramirez"
featured_image: "https://sqmagazine.co.uk/wp-content/uploads/2026/04/github-oauth-phishing-campaign.jpg"
categories:
  - name: "Cybersecurity"
    url: "/cybersecurity.md"
tags:
  - name: "News"
    url: "/tag/news.md"
---

# Developers Targeted in GitHub OAuth Phishing Campaign

A new phishing campaign is exploiting GitHub’s trusted notification system to trick developers into granting attackers deep access to their accounts.

## Quick Summary – TLDR:

- Attackers use GitHub issue notifications to deliver phishing emails from a trusted source.
- Malicious OAuth apps request powerful permissions, giving full access to repositories and workflows.
- This method bypasses MFA and traditional phishing defenses using legitimate GitHub flows.
- Thousands of repositories have already been impacted, highlighting a growing supply chain risk.

## What Happened?

Security researchers have identified a **stealthy phishing campaign** that abuses GitHub’s issue notification system to target developers. By combining **malicious OAuth applications** with trusted email alerts, attackers are able to trick users into granting access without stealing passwords.

The campaign uses **convincing security themed lures**, making it difficult for developers to distinguish between real alerts and phishing attempts.

## How the Attack Works?

At the core of this campaign is a clever misuse of **GitHub’s OAuth authorization system** and its **issue notification feature**.

Attackers begin by creating a **malicious OAuth app** that mimics a legitimate security tool or automated scanning service. These apps request **high risk permissions**, including:

- **Access to user email and profile data**.
- **Full control over public and private repositories**.
- **Permission to modify GitHub Actions workflows**.

Once the app is ready, attackers move to distribution.

They create **public repository issues** and tag specific users using @mentions. This action triggers an **automatic email notification** from GitHub’s official noreply address, making the message appear completely legitimate.

Inside the issue, attackers craft **fake security alerts** such as:

- **Warnings about malicious commits**.
- **Alerts for unusual login attempts**.
- **Claims of blocked intrusions**.

These messages are formatted using Markdown with **embedded phishing links** disguised as helpful actions like “**review activity**” or “**secure your account**.”

## Why This Attack Is So Effective?

This campaign stands out because it uses **GitHub’s own infrastructure** against its users.

Since the emails originate from GitHub:

- **They pass SPF and DKIM checks**.
- **They bypass spam filters**.
- **They look identical to real GitHub notifications**.

Instead of redirecting users to fake login pages, the links lead to a **real [GitHub](https://sqmagazine.co.uk/github-statistics/) OAuth authorization screen**.

This technique, known as **consent phishing**, tricks users into willingly granting access. Once authorized, attackers receive an **OAuth access token**, allowing persistent control without needing passwords or bypassing MFA directly.

In several observed cases, attackers also used a **time of check time of use trick**. They send the [phishing message](https://sqmagazine.co.uk/phishing-email-statistics/), then quickly edit or delete the issue content, leaving little trace in the repository while the email remains in the victim’s inbox.

## Scale and Impact

The [scale of this attack](https://sqmagazine.co.uk/cybersecurity-attacks-statistics/) is alarming.

Researchers report that **a single malicious OAuth app** has been used to target **around 12,000 repositories** in a short period. Because developers often have access to critical systems, a single compromised account can lead to:

- **Codebase tampering**.
- **Injection of backdoors into software**.
- **Manipulation of CI/CD pipelines**.
- **Exposure of sensitive data**.

This makes the attack a **serious supply chain threat**, where compromising one developer can impact entire organizations and downstream users.

## Security Recommendations

Experts are urging both developers and organizations to treat **OAuth app approvals as high risk actions**.

Key precautions include:

- **Avoid clicking links in unsolicited security alerts.**
- **Verify issues directly through GitHub’s official interface.**
- **Review and revoke unused OAuth app permissions regularly.**
- **Restrict which apps can access repository and workflow scopes.**
- **Monitor for unusual activity tied to OAuth tokens instead of logins.**

Developers should be especially cautious of apps claiming to be **security tools** while requesting broad access.

## SQ Magazine’s Takeaway

I think this attack is a wake up call for the entire developer ecosystem. What makes it dangerous is not just the technique, but how naturally it blends into everyday workflows. When something looks exactly like a real GitHub alert, most people will trust it without a second thought.

The bigger issue here is **trust in platforms**. If attackers can weaponize trusted systems like this, then security awareness alone is not enough. Developers and organizations need stricter controls around **OAuth permissions** and better visibility into what access has already been granted.