Hackers Use GitHub Notifications to Impersonate Y Combinator and Steal Wallet Funds

A recent wave of phishing attacks targeted developers and startups by impersonating Y Combinator through GitHub notifications. Victims were tricked into believing they had been selected for startup funding, only to face requests to verify their wallets or deposit funds for the next steps. The attackers registered multiple GitHub accounts and repository names close to Y Combinator, and created hundreds of issues per minute that tagged random users with messages that resembled official communications.

They also deployed GitHub Apps such as “ycombinatornotify” and “mail-notifaction-automatic” to bolster the perceived legitimacy of the messages, using both GitHub notifications and emails before the repositories were reported, deleted, or rate-limited. Fake domains like “y-comblnator[.]com” redirected victims to phishing pages designed to harvest wallet credentials or crypto deposits. GitHub has since deleted scam repositories and user accounts, though phishing notifications and lookalike domains may persist.