17 ms·

GitHub notification emails used to send malware

467 points by crtasm 2y ago

t_believ-er873 2y ago
It's worth checking every link you get even if it's from a trusted source, like GitHub... and to be able to restore the data, it's worth having a backup
qwertox 2y ago
It's worth the read, he shows what they're trying to do. Easy to be suspicious with the link alone, but its fun to see someone digging into it.
slig 2y ago
Seriously how hard it can be for GH to detect that a randomly just created account is creating issues, with the same text, containing a link inside? I got dozens of such spam during a whole day.
- nine_k 2y ago
  Once they introduce that, the texts will become more varied, and links, possibly, too. There are more possible next steps, which would make creating accounts for spamming more expensive, but they will also inconvenience well-meaning new users. I suspect that unless the problem of malicious spam from GitHub comments becomes rather serious, acting on the case by case basis may be the correct solution.
  - klabb3 2y ago
    > Once they introduce that, the texts will become more varied I’ve said for some time that, while LLMs are varying levels of useful for a lot of people, it’s practically tailor made for spam and phishing. I can’t think of any “product-market-fit” as good as that. For instance: Imagine combining a leak of personal data from your favorite data broker (who knew that this would come back and bite), with an LLM to bypass spam filters and perform phishing attacks with eerie believable social engineering behind it. All for next to no money.
elashri 2y ago
> The attacker quickly deletes the issue I realized I have never deleted an issue I started but doesn't people with admin access the only with ability to delete the issues on a repo? [1]. So actually there is a trace for that issue in the repository. Same thing for Pull requests. [1] https://docs.github.com/en/issues/tracking-your-work-with-issues/deleting-an-issue https://docs.github.com/en/issues/tracking-your-work-with-is...
- edm0nd 2y ago
  Repo owners can also edit the title and text of your Issue as well.
- 8organicbits 2y ago
  Maybe GitHub had already deleted it as malicious, but the email was already delivered.
  - tonygiorgio 2y ago
    I got this on two org repo’s yesterday. About an hour after the email, I checked and it was gone. I wanted to report it, even though GitHub scam reports are so very unsatisfying (weeks go by, then random email about how they took some action). One very simple measure I hope they implement is just not sending emails for unverified spam like this. I’d argue a majority of issues or comments do not need instant emails. Even one hour delay could help in combating abuse like this if they had any sort of reasonable moderation rules.
    - latexr 2y ago
      > GitHub scam reports are so very unsatisfying (weeks go by, then random email about how they took some action). Either you’re unlucky or I’m lucky, I’ve reported scammers to GitHub multiple times and always got a response in a couple of hours.
      - elashri 2y ago
        I reported spam comment and they acted in less than an hour. I reported the exact spam comment by another user in the same day and they took 3 months to act. It is a very random process.
theamk 2y ago
Do people really fall for scam like that? First, I assume the author knows the email came from github, as the screenshot does not show this very clearly. If that's the case: Red flag #1: email links to a variation of real domain. If you don't have information on who github-scanner.com is, it is pretty safe to assume it's a scam , just because it sounds like a real website. GIANT Enormous Huge Red Flag #2: captcha asks you to types command in shell. I have no comment on how naive one must be to do this.
- thephyber 2y ago
  It’s a numbers game. Nobody is perfect. The more features of credibility, most likely there will be a higher percentage of conversions. But not everybody has excellent vision, is not time-pressured, and is not tired/exhausted. There are lots of conditions that make otherwise difficult fraud targets more easy to trick. And if it can be done at large scale / automated, then small conversion rates turn into many successful frauds (compromised accounts).
  - szundi 2y ago
    Thanks for this summary. People often forget they (hopefully) have grandmas and themselves sometimes making mistakes as well for -- whoever knows what reason. Sometimes.
  - generic_dev_47 2y ago
    Agree, I once fell for a scam that I think I otherwise wouldn't because of string of circumstances: Being tired and stressed, it being Christmas time and I had actually ordered stuff but also because I had just upgraded iOS to the first version that put the address bar in Safari on the bottom of the screen instead of the top so I forgot to check the domain! I've since changed the address bar back to the top… In the end I didn't loose anything but it was a good wakeup call for sure.
  - acomjean 2y ago
    I think they’re hoping for coincidences and the higher the numbers the more likely they’ll find one. I got a real letter from the IRS two days before I got the scam message on my answering machine. The timing was uncanny and I might easily have fallen for it, had I not already dealt with it. It’s the same for the Chinese language calls, if you speak Chinese it really resonates. There was a scam in the 90s where you’d call a number and they’d give you sports betting advice. They’d do it for free as a promotion trying to sell their service when you won. They’d tell half the callers bet team A and the other half team B. The numbers made it work. “Splitting games 50-50 like that—known in the biz as "double-siding"—is the oldest trick in the handicapper's very thick book. That way he knows he has at least some happy customers coming back. “ https://vault.si.com/vault/1991/11/18/1-900-ripoffs-the-ads-for-call-in-services-that-offer-sure-thing-betting-advice-on-the-big-games-couldnt-be-more-tempting-our-own-hot-tip-dont-touch-that-phone https://vault.si.com/vault/1991/11/18/1-900-ripoffs-the-ads-...
kyledrake 2y ago
I received one of these notifications this morning and promptly ignored it. I had to laugh because it was about this repo specifically: https://github.com/kyledrake/theftcoinjs https://github.com/kyledrake/theftcoinjs
drexlspivey 2y ago
If your method of infecting your victim is having them paste and run a random command on their terminal, software developers is probably the worst group of people to be targeting.
- arccy 2y ago
  you'd be surprised at the quality of the average dev
- thephyber 2y ago
  “Curl pipe sh” would like to have a word… I think you are painting with a broad brush.
  - vultour 2y ago
    This is no different from installing a random package through a package manager. If you're running "curl pipe sh" because an email told you to, that's on you.
    - craftkiller 2y ago
      No it isn't. Package managers verify the cryptographically signed package. That means the package can be built on a secure server, and then if a mirror becomes malicious or gets compromised, the malicious package won't have a valid signature so the package will not be installed. Running curl and piping it into sh means that not only could a malicious mirror or compromised server execute anything they want on your computer, but they could even send a different script when you curl it into sh vs when you view it any other way, making it much harder to detect[0]. [0] https://web.archive.org/web/20240213030202/https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://web.archive.org/web/20240213030202/https://www.idont...
      - dylan604 2y ago
        I think the npm repos would like to have a word with you. Sure glad we've never had a cryptographically signed malicious package delivered via npm install
cebu_blue 2y ago
I don't understand whats special about this particular attack!>:( When I read the title I thought some automated GitHub emails were forged to sneakily point to a fake GitHub site or something. An obvious (for tech-savvy users) link pointing to an obvious malware (please copy and execute this code to solve the captcha.) If the people you are targeting fall for this why not send an old fashioned spam email with fake headers or via some hacked Wordpress installation? I guess using GitHub notifications is creative but in the end not much different than like sending a facebook message with a fake link, and the user getting an email notification with the message? The analysis of the malware once downloaded was certainly interesting, though!:)
fijiaarone 2y ago
This is neither hijacking notifications nor sending malware. This is someone including a link in a message on a ticketing system open to the public, and then someone clicking on the link and downloading malware.
crvdgc 2y ago
Months ago I got crypto ads through a similar approach, some fake new account @-ing hundreds of users in an issue and then the issue is removed. The net effect is that the ads become unblockable in your email box (It's from GitHub!). Maybe devs' target value in general has growing to a point where the openness of the system is more of a vulnerability than service.
throwaway984393 2y ago
[dead]
keyle 2y ago
Press Win+R, CTRL+V <enter> From captcha to gotcha. I could see junior developers falling for this. Hey it's Github, it's legit right? We get security notifications every second months about some lib everyone uses etc. "Oh look, captcha by running code, how neat!" I don't think webpages should be able to fill your copy/paste buffer from a click without a content preview. They made it requiring a user action, such as clicking, thinking that would solve the problem but it's still too weak. That's problem number 1. People need to stop actioning any links from emails and/or believing that any content in an email has legitimacy. It doesn't. That's problem number 2. Problem number 3, Windows still let you root a machine by 1 line in powershell? What the @$$%&%&#$? Github might need to stop people putting links in issues without being checked by automated services that can validate the content as remotely legitimate. They're sending this stuff to people's email, don't tell me they're not aware this could be used for fishing! That's cyber security 101, in 2015. Finally, Github, in being unable to act on the above, may need to better strip what they email to people, and essentially behave more like banks "you have a new issue in this repository..." and that's that. You then go there, there is no message, ok great. That would have taken care of this issue... It seems Github needs to graduate a bit here.
- peterweyand38 2y ago
  [flagged]
- ocdtrekkie 2y ago
  I've started disabling the Run dialog for non-technical users, but unfortunately a GitHub attack targets users who likely have a real use for it sometimes. The clipboard strategy feels like it should be easy to block too, most scammers just convince people to type a well-obscured URL into the Run dialog manually over the phone.
  - chii 2y ago
    > The clipboard strategy feels like it should be easy to block too yea, the browser should actually have each site ask for permission to modify the clipboard imho.
joshdavham 2y ago
These hackers need to work on the rest of their funnel lmao. Getting me to click the link would be easy, but running that script? Never in a million years!
rwestergren 2y ago
One one hand, I can see the captcha is easy to fall for. On the other, nothing says "prove you aren't a machine" like "run this code that a machine could easily run."
latexr 2y ago
> In text form (link altered for your safety) Might want to change the image too, macOS recognises the link in that and makes it clickable. I’d say that’s more dangerous than modifying it in the text of the post, you could just as well include a non-clickable text link.
johnklos 2y ago
Can be summarized with: Don't click on links in email. So is github-scanner.com (and github-scanner.shop) still the same malicious party? It seems to be. Funny that their DNS is hosted by Cloudflare (who, famously, don't host anything, because they think we're all dumb). Cloudflare, who take responsibility for nothing, has no way to report this kind of abuse to them. The domain which hosts the malware, 2x.si, both uses Cloudflare for DNS and is hosted by Cloudflare. At least it's possible to report this to Cloudflare, even though they rate limit humans and have CAPTCHAs on their abuse reporting forms. Sigh. Thanks to Cloudflare, it's trivial these days to host phishing and malware.
- AyyEye 2y ago
  [flagged]
- elashri 2y ago
  I don't know how effective and quick to respond but there is a way to report malware [1] Extracting from the page > Which category of abuse to select > Phishing & Malware https://www.cloudflare.com/trust-hub/reporting-abuse/ https://www.cloudflare.com/trust-hub/reporting-abuse/
  - johnklos 2y ago
    Cloudflare's abuse form will not let you submit the report if you don't include a URL that currently points to their network. There're no options for phishing / scam domains for which they're the registrar and/or DNS hosting.
    - ToValueFunfetti 2y ago
      I haven't tested the form, but they do claim you can report abuse of the registrar with some of the options, perhaps they've changed it? Failing that: > If Cloudflare is listed as the registrar on an ICANN WHOIS listing, you also can email reports related to our registrar services to registrar-abuse@cloudflare.com
- spoonfeeder006 2y ago
fforflo 2y ago
While we're here: what happened to the GitHub explore newsletter? I really enjoyed this, but I've stopped receiving it for a few months now. And I don't think I unsubscribed.
wazdra 2y ago
Fun how Microsoft is on both ends of the "exploit"
avazhi 2y ago
If you're stupid enough to paste something off a random website (that you discovered through a random email link) into the command line (and then execute it), then you deserve what happens next. At some point the end user is to blame. I also have no clue why any reasonable person would refer to that monstrosity as a CAPTCHA.
AlienRobot 2y ago
>verification steps >winkey+R >Ctrl+V >enter Of all things that seem legit, this seems the legitest.
xwall 2y ago
OMG! I was getting similar GitHub notification emails, saying detected vulnerability in your repo, but never figured it out as fake before this news, anyway I never clicked because I'm a lazy programmer :), once it's written it's written I do rewrite the code but don't find bugs and fix in my code. :D
- romantomjak 2y ago
  The GitHub security alert digest[1] is a real thing. It's a feature of GitHub where they report security vulnerabilities in your project's dependencies. For example, if you use python and you have specified requests library in your requirements.txt, GitHub will send you emails about disclosed vulnerabilities in that library, urging you to upgrade to a higher version where it's fixed. [1] https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts https://docs.github.com/en/code-security/dependabot/dependab...
deleted 2y ago
[deleted]
dabbz 2y ago
I've also been seeing Typeform emails coming from spam sources. Somehow people are using Typeform's positive reputation score to send emails to arbitrary emails.
bickett 2y ago
No org is safe, not even Github..
halostatue 2y ago
I turned off most GitHub emails and mostly use the Notification Centre for discovering things I need to know about. It's not entirely proof against phishing this way, but it doesn't get to use email to appear more legitimate.
mfi 2y ago
This has happened for a while. In February of this year, the same attack vector was used in an attack to trick developers into thinking that they'd got a job offer from GitHub: https://www.xorlab.com/en/blog/phishing-on-github https://www.xorlab.com/en/blog/phishing-on-github
dooer 2y ago
woah
deleted 2y ago
[deleted]
consumerx 2y ago
so many red-flags, i don't know how someone could go beyond and click this link.
- deleted 2y ago
  [deleted]
rnts08 2y ago
It's quite sad that in 2024 we still have people falling for the simplest tricks. This is almost as easy as it was to call someone and asking them for the number of the modem on their desk and their logins back in the bad old days. Considering the target platform I'm not overly surprised though.
- jonny_eh 2y ago
  It's quite sad that in 2024 that HN commenters still blame the victim, especially when the original author does a great job suggesting small changes that Microsoft can make to make their products safer for their users.
veltas 2y ago
I got a much more convincing email from PayPal recently, someone sent a quote (apparently a feature that can be used unsolicited), and set their company name to something like "PayPal need to get in touch about a your recent payment of $499.00, please call +1-....", so this is most of the text at the top because their quotes email is "<name> is sending you a quote for $xxx". This email came from the real PayPal.com, how they haven't gotten on top of usernames like that is beyond me for a payment processor. I reported it to them but haven't heard anything back, hopefully they banned that account but they should ban all names like that. This email honestly was formatted to look like a legit PayPal email, I have to imagine that scam will trick a lot of normal people. Get in touch, see my bio website, if you want the email.
- deleted 2y ago
  [deleted]
- akimbostrawman 2y ago
  >This email honestly was formatted to look like a legit PayPal email, this is why anything but plain text should be blocked in emails (besides security reasons). anybody with 5 minutes of HTML experience can create "legit looking" emails.
  - sofixa 2y ago
    It was an actual email sent by PayPal via a service they propose (sending invoices), just with a smartly crafted company name that made it look it's from them. No HTML was required from the attacker.
  - veltas 2y ago
    Legit looking because it was formatted by PayPal themselves, and also sent from PayPal.com.
- guappa 2y ago
  I'd be surprised if someone looked at it.
- davidd_1004 2y ago
1f60c 2y ago
Nice writeup! It reminded me a bit of Julia Evans' blog in terms of content (learning by teaching).
jonathanlydall 2y ago
Just this morning I logged a bug on a GitHub repo and within a minute someone responded with something to the effect of: Try this, I think it will fix your issue (install GCC if you need a compiler): (Bitly link redirecting to zip file on mediafire) Pass: (something) GitHub processed my abuse report within an hour and removed all posts by that user.
meindnoch 2y ago
Not hijacked. Faked.
Thomashuet 2y ago
Their claim that nothing tells you the email corresponds to the new issue is wrong, the "(Issue #1)" in the title means exactly that. I have actually received the same email myself and immediately recognized it as a new issue created on the repo. This user is obviously not used to GitHub issues as is made clear by the fact that this is the first issue on this repo. I guess GitHub needs to do a better job teaching new users.
- selykg 2y ago
  True, but I have worked at companies who employ users that maybe aren't entirely up to speed on the technical details and they have GitHub account's for submitting bug reports. This would very easily fool some of these people. Technical people might spot this, but that also isn't a free pass for GitHub to not do better here.
ezekiel68 2y ago
An excellent slashvertisement for Virus Total. Wrapped in an important cautionary tale about how GitHub issues can be manipulated to try to spread malware.

467 points by crtasm 2y ago

It's worth checking every link you get even if it's from a trusted source, like GitHub... and to be able to restore the data, it's worth having a backup

qwertox 2y ago

It's worth the read, he shows what they're trying to do. Easy to be suspicious with the link alone, but its fun to see someone digging into it.

slig 2y ago

Seriously how hard it can be for GH to detect that a randomly just created account is creating issues, with the same text, containing a link inside? I got dozens of such spam during a whole day.

nine_k 2y ago
Once they introduce that, the texts will become more varied, and links, possibly, too. There are more possible next steps, which would make creating accounts for spamming more expensive, but they will also inconvenience well-meaning new users. I suspect that unless the problem of malicious spam from GitHub comments becomes rather serious, acting on the case by case basis may be the correct solution.
- klabb3 2y ago
  > Once they introduce that, the texts will become more varied I’ve said for some time that, while LLMs are varying levels of useful for a lot of people, it’s practically tailor made for spam and phishing. I can’t think of any “product-market-fit” as good as that. For instance: Imagine combining a leak of personal data from your favorite data broker (who knew that this would come back and bite), with an LLM to bypass spam filters and perform phishing attacks with eerie believable social engineering behind it. All for next to no money.

elashri 2y ago

> The attacker quickly deletes the issue I realized I have never deleted an issue I started but doesn't people with admin access the only with ability to delete the issues on a repo? [1]. So actually there is a trace for that issue in the repository. Same thing for Pull requests. [1] https://docs.github.com/en/issues/tracking-your-work-with-issues/deleting-an-issue https://docs.github.com/en/issues/tracking-your-work-with-is...

edm0nd 2y ago
Repo owners can also edit the title and text of your Issue as well.
8organicbits 2y ago
Maybe GitHub had already deleted it as malicious, but the email was already delivered.
- tonygiorgio 2y ago
  I got this on two org repo’s yesterday. About an hour after the email, I checked and it was gone. I wanted to report it, even though GitHub scam reports are so very unsatisfying (weeks go by, then random email about how they took some action). One very simple measure I hope they implement is just not sending emails for unverified spam like this. I’d argue a majority of issues or comments do not need instant emails. Even one hour delay could help in combating abuse like this if they had any sort of reasonable moderation rules.
  - latexr 2y ago
    > GitHub scam reports are so very unsatisfying (weeks go by, then random email about how they took some action). Either you’re unlucky or I’m lucky, I’ve reported scammers to GitHub multiple times and always got a response in a couple of hours.
    - elashri 2y ago
      I reported spam comment and they acted in less than an hour. I reported the exact spam comment by another user in the same day and they took 3 months to act. It is a very random process.

theamk 2y ago

Do people really fall for scam like that? First, I assume the author knows the email came from github, as the screenshot does not show this very clearly. If that's the case: Red flag #1: email links to a variation of real domain. If you don't have information on who github-scanner.com is, it is pretty safe to assume it's a scam , just because it sounds like a real website. GIANT Enormous Huge Red Flag #2: captcha asks you to types command in shell. I have no comment on how naive one must be to do this.

thephyber 2y ago
It’s a numbers game. Nobody is perfect. The more features of credibility, most likely there will be a higher percentage of conversions. But not everybody has excellent vision, is not time-pressured, and is not tired/exhausted. There are lots of conditions that make otherwise difficult fraud targets more easy to trick. And if it can be done at large scale / automated, then small conversion rates turn into many successful frauds (compromised accounts).
- szundi 2y ago
  Thanks for this summary. People often forget they (hopefully) have grandmas and themselves sometimes making mistakes as well for -- whoever knows what reason. Sometimes.
- generic_dev_47 2y ago
  Agree, I once fell for a scam that I think I otherwise wouldn't because of string of circumstances: Being tired and stressed, it being Christmas time and I had actually ordered stuff but also because I had just upgraded iOS to the first version that put the address bar in Safari on the bottom of the screen instead of the top so I forgot to check the domain! I've since changed the address bar back to the top… In the end I didn't loose anything but it was a good wakeup call for sure.
- acomjean 2y ago
  I think they’re hoping for coincidences and the higher the numbers the more likely they’ll find one. I got a real letter from the IRS two days before I got the scam message on my answering machine. The timing was uncanny and I might easily have fallen for it, had I not already dealt with it. It’s the same for the Chinese language calls, if you speak Chinese it really resonates. There was a scam in the 90s where you’d call a number and they’d give you sports betting advice. They’d do it for free as a promotion trying to sell their service when you won. They’d tell half the callers bet team A and the other half team B. The numbers made it work. “Splitting games 50-50 like that—known in the biz as "double-siding"—is the oldest trick in the handicapper's very thick book. That way he knows he has at least some happy customers coming back. “ https://vault.si.com/vault/1991/11/18/1-900-ripoffs-the-ads-for-call-in-services-that-offer-sure-thing-betting-advice-on-the-big-games-couldnt-be-more-tempting-our-own-hot-tip-dont-touch-that-phone https://vault.si.com/vault/1991/11/18/1-900-ripoffs-the-ads-...

kyledrake 2y ago

I received one of these notifications this morning and promptly ignored it. I had to laugh because it was about this repo specifically: https://github.com/kyledrake/theftcoinjs https://github.com/kyledrake/theftcoinjs

drexlspivey 2y ago

If your method of infecting your victim is having them paste and run a random command on their terminal, software developers is probably the worst group of people to be targeting.

arccy 2y ago
you'd be surprised at the quality of the average dev
thephyber 2y ago
“Curl pipe sh” would like to have a word… I think you are painting with a broad brush.
- vultour 2y ago
  This is no different from installing a random package through a package manager. If you're running "curl pipe sh" because an email told you to, that's on you.
  - craftkiller 2y ago
    No it isn't. Package managers verify the cryptographically signed package. That means the package can be built on a secure server, and then if a mirror becomes malicious or gets compromised, the malicious package won't have a valid signature so the package will not be installed. Running curl and piping it into sh means that not only could a malicious mirror or compromised server execute anything they want on your computer, but they could even send a different script when you curl it into sh vs when you view it any other way, making it much harder to detect[0]. [0] https://web.archive.org/web/20240213030202/https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://web.archive.org/web/20240213030202/https://www.idont...
    - dylan604 2y ago
      I think the npm repos would like to have a word with you. Sure glad we've never had a cryptographically signed malicious package delivered via npm install

cebu_blue 2y ago

I don't understand whats special about this particular attack!>:( When I read the title I thought some automated GitHub emails were forged to sneakily point to a fake GitHub site or something. An obvious (for tech-savvy users) link pointing to an obvious malware (please copy and execute this code to solve the captcha.) If the people you are targeting fall for this why not send an old fashioned spam email with fake headers or via some hacked Wordpress installation? I guess using GitHub notifications is creative but in the end not much different than like sending a facebook message with a fake link, and the user getting an email notification with the message? The analysis of the malware once downloaded was certainly interesting, though!:)

fijiaarone 2y ago

This is neither hijacking notifications nor sending malware. This is someone including a link in a message on a ticketing system open to the public, and then someone clicking on the link and downloading malware.

crvdgc 2y ago

Months ago I got crypto ads through a similar approach, some fake new account @-ing hundreds of users in an issue and then the issue is removed. The net effect is that the ads become unblockable in your email box (It's from GitHub!). Maybe devs' target value in general has growing to a point where the openness of the system is more of a vulnerability than service.

throwaway984393 2y ago

[dead]

keyle 2y ago

Press Win+R, CTRL+V <enter> From captcha to gotcha. I could see junior developers falling for this. Hey it's Github, it's legit right? We get security notifications every second months about some lib everyone uses etc. "Oh look, captcha by running code, how neat!" I don't think webpages should be able to fill your copy/paste buffer from a click without a content preview. They made it requiring a user action, such as clicking, thinking that would solve the problem but it's still too weak. That's problem number 1. People need to stop actioning any links from emails and/or believing that any content in an email has legitimacy. It doesn't. That's problem number 2. Problem number 3, Windows still let you root a machine by 1 line in powershell? What the @$$%&%&#$? Github might need to stop people putting links in issues without being checked by automated services that can validate the content as remotely legitimate. They're sending this stuff to people's email, don't tell me they're not aware this could be used for fishing! That's cyber security 101, in 2015. Finally, Github, in being unable to act on the above, may need to better strip what they email to people, and essentially behave more like banks "you have a new issue in this repository..." and that's that. You then go there, there is no message, ok great. That would have taken care of this issue... It seems Github needs to graduate a bit here.

peterweyand38 2y ago
[flagged]
ocdtrekkie 2y ago
I've started disabling the Run dialog for non-technical users, but unfortunately a GitHub attack targets users who likely have a real use for it sometimes. The clipboard strategy feels like it should be easy to block too, most scammers just convince people to type a well-obscured URL into the Run dialog manually over the phone.
- chii 2y ago
  > The clipboard strategy feels like it should be easy to block too yea, the browser should actually have each site ask for permission to modify the clipboard imho.

joshdavham 2y ago

These hackers need to work on the rest of their funnel lmao. Getting me to click the link would be easy, but running that script? Never in a million years!

rwestergren 2y ago

One one hand, I can see the captcha is easy to fall for. On the other, nothing says "prove you aren't a machine" like "run this code that a machine could easily run."

latexr 2y ago

> In text form (link altered for your safety) Might want to change the image too, macOS recognises the link in that and makes it clickable. I’d say that’s more dangerous than modifying it in the text of the post, you could just as well include a non-clickable text link.

johnklos 2y ago

Can be summarized with: Don't click on links in email. So is github-scanner.com (and github-scanner.shop) still the same malicious party? It seems to be. Funny that their DNS is hosted by Cloudflare (who, famously, don't host anything, because they think we're all dumb). Cloudflare, who take responsibility for nothing, has no way to report this kind of abuse to them. The domain which hosts the malware, 2x.si, both uses Cloudflare for DNS and is hosted by Cloudflare. At least it's possible to report this to Cloudflare, even though they rate limit humans and have CAPTCHAs on their abuse reporting forms. Sigh. Thanks to Cloudflare, it's trivial these days to host phishing and malware.

AyyEye 2y ago
[flagged]
elashri 2y ago
I don't know how effective and quick to respond but there is a way to report malware [1] Extracting from the page > Which category of abuse to select > Phishing & Malware https://www.cloudflare.com/trust-hub/reporting-abuse/ https://www.cloudflare.com/trust-hub/reporting-abuse/
- johnklos 2y ago
  Cloudflare's abuse form will not let you submit the report if you don't include a URL that currently points to their network. There're no options for phishing / scam domains for which they're the registrar and/or DNS hosting.
  - ToValueFunfetti 2y ago
    I haven't tested the form, but they do claim you can report abuse of the registrar with some of the options, perhaps they've changed it? Failing that: > If Cloudflare is listed as the registrar on an ICANN WHOIS listing, you also can email reports related to our registrar services to registrar-abuse@cloudflare.com
spoonfeeder006 2y ago

fforflo 2y ago

While we're here: what happened to the GitHub explore newsletter? I really enjoyed this, but I've stopped receiving it for a few months now. And I don't think I unsubscribed.

wazdra 2y ago

Fun how Microsoft is on both ends of the "exploit"

avazhi 2y ago

If you're stupid enough to paste something off a random website (that you discovered through a random email link) into the command line (and then execute it), then you deserve what happens next. At some point the end user is to blame. I also have no clue why any reasonable person would refer to that monstrosity as a CAPTCHA.

AlienRobot 2y ago

>verification steps >winkey+R >Ctrl+V >enter Of all things that seem legit, this seems the legitest.

xwall 2y ago

OMG! I was getting similar GitHub notification emails, saying detected vulnerability in your repo, but never figured it out as fake before this news, anyway I never clicked because I'm a lazy programmer :), once it's written it's written I do rewrite the code but don't find bugs and fix in my code. :D

romantomjak 2y ago
The GitHub security alert digest[1] is a real thing. It's a feature of GitHub where they report security vulnerabilities in your project's dependencies. For example, if you use python and you have specified requests library in your requirements.txt, GitHub will send you emails about disclosed vulnerabilities in that library, urging you to upgrade to a higher version where it's fixed. [1] https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts https://docs.github.com/en/code-security/dependabot/dependab...

deleted 2y ago

[deleted]

dabbz 2y ago

I've also been seeing Typeform emails coming from spam sources. Somehow people are using Typeform's positive reputation score to send emails to arbitrary emails.

bickett 2y ago

No org is safe, not even Github..

halostatue 2y ago

I turned off most GitHub emails and mostly use the Notification Centre for discovering things I need to know about. It's not entirely proof against phishing this way, but it doesn't get to use email to appear more legitimate.

mfi 2y ago

This has happened for a while. In February of this year, the same attack vector was used in an attack to trick developers into thinking that they'd got a job offer from GitHub: https://www.xorlab.com/en/blog/phishing-on-github https://www.xorlab.com/en/blog/phishing-on-github

dooer 2y ago

woah

deleted 2y ago

[deleted]

consumerx 2y ago

so many red-flags, i don't know how someone could go beyond and click this link.

deleted 2y ago
[deleted]

rnts08 2y ago

It's quite sad that in 2024 we still have people falling for the simplest tricks. This is almost as easy as it was to call someone and asking them for the number of the modem on their desk and their logins back in the bad old days. Considering the target platform I'm not overly surprised though.

jonny_eh 2y ago
It's quite sad that in 2024 that HN commenters still blame the victim, especially when the original author does a great job suggesting small changes that Microsoft can make to make their products safer for their users.

veltas 2y ago

I got a much more convincing email from PayPal recently, someone sent a quote (apparently a feature that can be used unsolicited), and set their company name to something like "PayPal need to get in touch about a your recent payment of $499.00, please call +1-....", so this is most of the text at the top because their quotes email is "<name> is sending you a quote for $xxx". This email came from the real PayPal.com, how they haven't gotten on top of usernames like that is beyond me for a payment processor. I reported it to them but haven't heard anything back, hopefully they banned that account but they should ban all names like that. This email honestly was formatted to look like a legit PayPal email, I have to imagine that scam will trick a lot of normal people. Get in touch, see my bio website, if you want the email.

deleted 2y ago
[deleted]
akimbostrawman 2y ago
>This email honestly was formatted to look like a legit PayPal email, this is why anything but plain text should be blocked in emails (besides security reasons). anybody with 5 minutes of HTML experience can create "legit looking" emails.
- sofixa 2y ago
  It was an actual email sent by PayPal via a service they propose (sending invoices), just with a smartly crafted company name that made it look it's from them. No HTML was required from the attacker.
- veltas 2y ago
  Legit looking because it was formatted by PayPal themselves, and also sent from PayPal.com.
guappa 2y ago
I'd be surprised if someone looked at it.
davidd_1004 2y ago

1f60c 2y ago

Nice writeup! It reminded me a bit of Julia Evans' blog in terms of content (learning by teaching).

jonathanlydall 2y ago

Just this morning I logged a bug on a GitHub repo and within a minute someone responded with something to the effect of: Try this, I think it will fix your issue (install GCC if you need a compiler): (Bitly link redirecting to zip file on mediafire) Pass: (something) GitHub processed my abuse report within an hour and removed all posts by that user.

meindnoch 2y ago

Not hijacked. Faked.

Thomashuet 2y ago

Their claim that nothing tells you the email corresponds to the new issue is wrong, the "(Issue #1)" in the title means exactly that. I have actually received the same email myself and immediately recognized it as a new issue created on the repo. This user is obviously not used to GitHub issues as is made clear by the fact that this is the first issue on this repo. I guess GitHub needs to do a better job teaching new users.

selykg 2y ago
True, but I have worked at companies who employ users that maybe aren't entirely up to speed on the technical details and they have GitHub account's for submitting bug reports. This would very easily fool some of these people. Technical people might spot this, but that also isn't a free pass for GitHub to not do better here.

ezekiel68 2y ago

An excellent slashvertisement for Virus Total. Wrapped in an important cautionary tale about how GitHub issues can be manipulated to try to spread malware.