Researchers have uncovered a stealthy phishing technique that weaponizes GitHub’s own notification system to deliver credential-harvesting lures directly to developers’ inboxes completely bypassing multi-factor authentication (MFA) and traditional phishing defenses.
Developers have emerged as a top-priority target for threat actors because of their privileged position in the software supply chain.
As builders of the code running in CI/CD pipelines, production servers, and end-user machines, compromising a single developer account can cascade into catastrophic organizational breaches.
This type of attack is broadly categorized as a supply chain attack, where adversaries compromise trusted third parties to reach larger targets at scale.
Recent high-profile examples include compromised packages in the Axios and LiteLLM ecosystems, each carrying over 100 million weekly downloads.
How The GitHub OAuth Phishing Attack Works
The attack chain begins with a threat actor creating a GitHub account and registering a malicious OAuth 2.0 application designed to impersonate a legitimate automated security scanning service.
OAuth apps use GitHub’s authorization framework to request specific user permissions via an access token.
In this scenario, the attacker requests a dangerous combination of scopes: user:email, read: user, repo (full read/write on all public and private repositories), and workflow (read/write access to GitHub Actions).
With these permissions, an attacker gains near-total control over a victim’s GitHub account including the ability to view private repositories, inject backdoored code, and manipulate CI/CD pipeline configurations.
To deliver the lure, the attacker exploits GitHub’s issue notification system. When a GitHub user is mentioned (@username) in a public repository issue, GitHub automatically sends an email notification to their primary address originating from the trusted noreply@github.com domain.
Attackers craft a convincing fake security alert as the issue body, using Markdown formatting to embed phishing links behind legitimate-looking anchor text.
A sample pretext used in observed campaigns warned victims of a “blocked intrusion via malicious commit,” complete with fake timestamps, commit hashes, and urgency-inducing calls to action.
Because the email originates from GitHub’s own infrastructure and lands in the developer’s inbox through a trusted notification pathway, it reliably bypasses spam filters and raises minimal suspicion.
To further evade detection, attackers mask the OAuth authorization URL using link shorteners a necessary step, as GitHub has been observed flagging and removing issues that directly embed github.com/login/oauth/authorize URLs, leading to the deletion of the OAuth app and permanent account banning.
Researchers also discovered a Time-of-Check Time-of-Use (TOCTOU) race condition within GitHub’s notification system.
An attacker can create an issue that mentions the target atsika triggering the email notification — then immediately edit the issue to erase all phishing content before the victim visits the repository.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
