A new phishing campaign is exploiting GitHub’s trusted notification system to trick developers into granting attackers deep access to their accounts.
Quick Summary – TLDR:
- Attackers use GitHub issue notifications to deliver phishing emails from a trusted source.
- Malicious OAuth apps request powerful permissions, giving full access to repositories and workflows.
- This method bypasses MFA and traditional phishing defenses using legitimate GitHub flows.
- Thousands of repositories have already been impacted, highlighting a growing supply chain risk.
What Happened?
Security researchers have identified a stealthy phishing campaign that abuses GitHub’s issue notification system to target developers. By combining malicious OAuth applications with trusted email alerts, attackers are able to trick users into granting access without stealing passwords.
The campaign uses convincing security themed lures, making it difficult for developers to distinguish between real alerts and phishing attempts.
How the Attack Works?
At the core of this campaign is a clever misuse of GitHub’s OAuth authorization system and its issue notification feature.
Attackers begin by creating a malicious OAuth app that mimics a legitimate security tool or automated scanning service. These apps request high risk permissions, including:
- Access to user email and profile data.
- Full control over public and private repositories.
- Permission to modify GitHub Actions workflows.
Once the app is ready, attackers move to distribution.
They create public repository issues and tag specific users using @mentions. This action triggers an automatic email notification from GitHub’s official noreply address, making the message appear completely legitimate.
Inside the issue, attackers craft fake security alerts such as:
- Warnings about malicious commits.
- Alerts for unusual login attempts.
- Claims of blocked intrusions.
These messages are formatted using Markdown with embedded phishing links disguised as helpful actions like “review activity” or “secure your account.”
Why This Attack Is So Effective?
This campaign stands out because it uses GitHub’s own infrastructure against its users.
Since the emails originate from GitHub:
- They pass SPF and DKIM checks.
- They bypass spam filters.
- They look identical to real GitHub notifications.
Instead of redirecting users to fake login pages, the links lead to a real GitHub OAuth authorization screen.
This technique, known as consent phishing, tricks users into willingly granting access. Once authorized, attackers receive an OAuth access token, allowing persistent control without needing passwords or bypassing MFA directly.
In several observed cases, attackers also used a time of check time of use trick. They send the phishing message, then quickly edit or delete the issue content, leaving little trace in the repository while the email remains in the victim’s inbox.
Scale and Impact
The scale of this attack is alarming.
Researchers report that a single malicious OAuth app has been used to target around 12,000 repositories in a short period. Because developers often have access to critical systems, a single compromised account can lead to:
- Codebase tampering.
- Injection of backdoors into software.
- Manipulation of CI/CD pipelines.
- Exposure of sensitive data.
This makes the attack a serious supply chain threat, where compromising one developer can impact entire organizations and downstream users.
Security Recommendations
Experts are urging both developers and organizations to treat OAuth app approvals as high risk actions.
Key precautions include:
- Avoid clicking links in unsolicited security alerts.
- Verify issues directly through GitHub’s official interface.
- Review and revoke unused OAuth app permissions regularly.
- Restrict which apps can access repository and workflow scopes.
- Monitor for unusual activity tied to OAuth tokens instead of logins.
Developers should be especially cautious of apps claiming to be security tools while requesting broad access.
SQ Magazine’s Takeaway
I think this attack is a wake up call for the entire developer ecosystem. What makes it dangerous is not just the technique, but how naturally it blends into everyday workflows. When something looks exactly like a real GitHub alert, most people will trust it without a second thought.
The bigger issue here is trust in platforms. If attackers can weaponize trusted systems like this, then security awareness alone is not enough. Developers and organizations need stricter controls around OAuth permissions and better visibility into what access has already been granted.
