Observations of Phishing Notifications

[con-cis]

Discussion Type

Question

Discussion Content

I recently received an email containing a GitHub mention directed to me. The subject and content of this notification appear to be part of a phishing attempt [PillarAttorney73/VSRelease-60058] Visual Studio Code - High-Risk Security Issue - Emergency Action Alert (Discussion #5)] from User "PluginUpdate-98626", and the defanged link hxxp://share.google/...

Could you clarify why this phishing mention was delivered to me? Was this due to a timing or filtering issue that allowed a malicious notification to bypass GitHub’s usual anti-spam and phishing protections?

[dav1312]

The scale of the attack might have something to do with it. It was thousands of accounts, repositories, and discussions.

[ayushcmd]

This is the same wave of phishing attacks that many users received recently. I actually dealt with this exact same situation — my senior got the same email, same fake CVE format, same Google Drive link, and was completely panicked thinking his account was compromised.
The reason it bypassed GitHub's filters is that the attackers did not send any external email — they used GitHub's own notification system by mass @mentioning users inside a Discussion. Since the notification originates from GitHub itself, there is nothing for the spam filter to catch at the email level.
As dav1312 mentioned, the scale was massive — thousands of accounts and repositories were involved, which means the filter was overwhelmed before it could react. GitHub's anti-spam works reactively in cases like this, meaning the repo gets taken down after reports come in, not before the notifications go out.
Just report the repo and you are safe. Your account was never touched.

[con-cis]

I ran into a rate-limiting screen on GitHub earlier that day, which led me to consider whether this might be part of a combined attack.

[dav1312]

Another scam going on right now https://github.com/search?q=%22Invitation+from+uniswap%22&type=discussions&s=date_created&o=desc&p=1

[DGrothe-PhD]

Quote: "Hello,
Your latest activity on GitHub got our interest. We are scaling Uniswap and looking for engineers..." while tagging a bunch of accounts