- Security scientists see new phishing -campaign that is targeting GitHub -users
- A false “security alert” GitHub account notified users of suspicious logins
- The links in the message all point to a shady app
Cyber criminals are about to decay security warnings on GitHub to get unsuspecting users to install malicious applications and lose their work, experts have warned.
A security researcher alias “LC4M” discovered the campaign and shared a detailed explanation in a short X wire, noting that attackers created a GitHub account called “GitHub notification” and then opened a problem for a “well -known security rep” indicating “security alarm: unusual access attempt”.
“We’ve discovered a login attempt in your GitHub account that seems to be from a new place or device,” says the false alarm. “If you recognize this activity, no further actions are required.
OAUTH app
The alarm says the login attempt came from Reykjavik, Iceland and shares links where users can update their password, review and manage active sessions and even enable two-factor approval (2FA).
However, all the links to a GitHub authorization page lead to an OAuth app called “GitsecurityApp”. This app requests several permits, including those providing full access to public and private warehouses, the opportunity to read and write to the user profile, access to GitHub Gists, permission to delete warehouses and more.
The researcher updated his thread to say that at least 8,000 GitHub stocks were targeted. However a Bleeping computer The report sets the number of goals of 12,000.
If you were targeted by this campaign and ended up giving the permits, you should revoke access as soon as possible and then – turn your credentials and the approval token just to be on the safe side.
LC4M couldn’t certainly attribute the campaign to any known threat actor, but they have their suspicion: “Does dpkr?” They said and suggested that this could be the work of the North Korean state -sponsored threat actors.
