Hackers Exploit GitHub Notifications to Launch Phishing Attacks

Cybersecurity researchers have uncovered a phishing campaign that exploits GitHub’s official notification system to deliver malicious links and credential-stealing payloads. The attack hinges on messages that mimic GitHub’s standard notification format, reusing the familiar logo, header styling, and footer links to exploit the trust developers place in GitHub’s communications.

Recipients are warned of new collaborator invitations, pending pull-request reviews, or security alerts, while the links actually redirect to attacker-controlled domains designed to harvest GitHub credentials. Victims entering username and password on these spoofed sites are described as potentially granting threat actors full access to their code repositories and private data.

A notable twist is the use of Gitcoin’s Developer Fund announcements as lure, including a refundable deposit requirement to pressure users into proceeding. Mitigations suggested include verifying the actual URL behind links, enabling two-factor authentication, and deploying DMARC policies, alongside broader awareness and layered email security measures.