‼️ just got a pretty smart github OAuth phishing/ATO attempt on my personal account.
attacker created a repo named after my github username, opened an issue mentioning me with a fake account-access alert, which triggered a real email from notifications@github.com.
“This wasn’t me” → attacker-controlled GitHub Pages → real
github.com OAuth consent page for an app called “profile security settings”, asking for public/private repo access + permission to update GitHub Actions workflow files.
no fake github login page. the email is github, the auth page is github. the malicious part is the OAuth app + redirect flow.
the page is just an obfuscated redirector, while the OAuth callback forwards the returned code/state to the same backend:
github.com/api6268/code-839c…
also caught two other username-specific phishing issues from the same github account before they disappeared.
some indicators:
issue account: 6119f4f
OAuth app: profile security settings
consent: Authorize request-6286
landing: api6268[.]github[.]io/code-839c74ee/
related landing: api25cd[.]github[.]io/account-13e95c92/
callback: request-6286[.]github[.]io
backend: gitmain[.]serveblog[.]net
route ID: 9e52a992