Hackers Leverage GitHub Notifications to Mimic as Y Combinator to Steal Funds from Wallets
Cybercriminals have executed a phishing campaign exploiting GitHub's notification system. This attack impersonates the startup accelerator Y Combinator to target developers' cryptocurrency wallets through fraudulent funding opportunity notifications.
Cybercriminals have executed a phishing campaign exploiting GitHub's notification system. This attack impersonates the startup accelerator Y Combinator to target developers' cryptocurrency wallets through fraudulent funding opportunity notifications.
The attack utilizes GitHub's issue tracking system to distribute phishing notifications, circumventing traditional email security measures by using GitHub's legitimate notification infrastructure.
Threat actors generated multiple GitHub accounts with names resembling Y Combinator, such as ycombinato and ycoommbinator, and employed a malicious GitHub application named ycombinatornotify.
Attackers demonstrated knowledge of GitHub's API limitations and notification systems. Each malicious repository created up to 500 issues, containing phishing content and tagging numerous GitHub usernames to increase notification reach.
The notifications appeared legitimate as they originated from GitHub's official notification system , making immediate identification of fraud challenging for users.
Cybercriminals have executed a phishing campaign exploiting GitHub's notification system.
Phishing messages claimed recipients were "selected for funding" and required wallet verification to access purported Y Combinator investment opportunities.
This social engineering tactic targeted developers familiar with Y Combinator's legitimate application process, exploiting the program's prestige.
The operation utilized typosquatting, registering y-comblnator.com to mimic Y Combinator's website, hosting fake application pages to collect cryptocurrency wallet credentials and private keys.
GitHub's security team suspended the malicious accounts and repositories. However, the attack's distributed nature across multiple accounts presented persistent challenges.
Affected users reported persistent notification badges, requiring manual API calls to clear, using commands like curl -X PATCH with authentication tokens.
The incident underscores the vulnerability of collaborative development platforms to abuse, highlighting how legitimate notification systems can be exploited for large-scale phishing campaigns targeting high-value technical professionals.
Based on reporting by Cyber Security News.