A new phishing campaign is targeting developers by exploiting GitHub’s legitimate infrastructure.
This sophisticated attack involves fake job offers sent from genuine GitHub email addresses, posing a threat to corporate information security, especially for developers with administrative access to company repositories.
GitHub Account Hijacking: The Phishing Tactic
The attack begins with an email from [email protected], a legitimate GitHub address.
The email claims that GitHub is seeking an experienced developer. It offers an enticing salary of $180,000 per year along with generous benefits. Recipients are invited to apply via a link in the email.
Despite coming from a genuine address, the email raises several red flags. The HR team using a notification address for job offers is unusual, and the email subject often doesn’t align with the job offer, so they list several GitHub usernames instead.
Are You From SOC/DFIR Teams? - Try Advanced Malware and Phishing Analysis With ANY.RUN -14-day free trial
Those distracted by the attractive salary might overlook these discrepancies. Clicking the link directs recipients to a fake GitHub career site, such as githubtalentcommunity[.]online or githubcareers[.]online.
Here, developers are asked to log in to their GitHub account and authorize a malicious OAuth application, which requests extensive permissions, including access to private repositories and the ability to delete them.
The Consequences: Repository Wipe and Ransom Demand
According to the Kaspersky reports, attackers exploit the granted permissions once the malicious OAuth application is authorized.
They empty the victim’s repositories, renaming them and leaving behind a single README.me file.
This file contains a ransom note claiming that a data backup has been made and instructing the victim to contact a Gitloker user on Telegram to restore the data.
The attackers send these phishing emails using GitHub’s discussion system. Using already compromised accounts, they create messages under various topics, tagging multiple users.
As a result, all tagged users receive emails from a legitimate email address, making the attack appear credible.
These messages are typically deleted immediately after being sent, further complicating detection.
Protecting Against GitHub Phishing Attacks
Even experienced developers can fall prey to such sophisticated phishing tactics. To safeguard against these attacks, it is crucial to follow these recommendations:
- Scrutinize Email Details: Carefully check all aspects of an email, including the subject, text, and sender address. Discrepancies often indicate a phishing attempt rather than an accidental error.
- Avoid Clicking Suspicious Links: If you receive a suspicious email from GitHub, refrain from clicking any links and report the email to GitHub support.
- Be Cautious with OAuth Applications: Never authorize unknown OAuth applications. Regularly review the list of authorized applications in your GitHub account and remove any suspicious ones.
By staying vigilant and following these guidelines, developers can help protect themselves and their organizations from these malicious phishing campaigns.
As attackers refine their methods, awareness and proactive measures remain the best defense against such threats.
Protect Your Business with Cynet Managed All-in-One Cybersecurity Platform – Try Free Trial