Phishing Delivery: Attackers send fake GitHub security alerts via GitHub Issues, warning of a suspicious login attempt. The message mimics an official security notification and urges users to review the login details, leading them to a malicious OAuth authorization page instead of GitHub’s security settings.
Fake GitHub Security Alerts Exploit OAuth to Hijack Developer Accounts
Scammers abuse GitHub issues and OAuth apps to bypass traditional SEGs.
What is the attack?
OAuth Abuse: Instead of stealing passwords, the attack deceives victims into approving a rogue OAuth app, giving attackers persistent access to their GitHub account, code repositories, and permissions to modify the data.
Why did it get through?
Verified Source: Email sent from a domain passing sender authentication checks.
Legitimate Hosting: The phishing messages were posted via GitHub Issues, making them appear legitimate.
OAuth App Bypass: Attackers avoid MFA & credential-based detection since OAuth grants direct API access.
What is required to solve for this attack?
Behavioral Analysis: Abnormal’s Behavioral AI flags never-before-seen senders, unusual email content, and URLs as anomalies that enable the detection of novel attacks.
Content Analysis and Natural Language Processing: Abnormal understands the email's content, recognizing the urgency and financial implications as indicators of a financial themed attack.