PhishingReviewed
GhostAction attackers phish GitHub maintainers from noreply@my-github.com fake security alerts
OpenSourceMalware says GhostAction attackers registered my-github.com and sent fake GitHub security alerts from noreply@my-github.com to steal maintainers' passwords, 2FA codes and OAuth tokens, The Hacker News reports. GitHub isn't involved.
- my-github.com
- noreply@my-github.com
- IP 193.32.204.199; exfiltration to my-github.com on TCP 8443
Reported Oct 19, 20261 report