Hackers Use GitHub Notifications to Impersonate Y Combinator and Steal Wallet Funds
Recent phishing attacks have targeted developers and startups by impersonating Y Combinator through GitHub notifications, leading to financial theft via fake verification schemes.
Recent phishing attacks have targeted developers and startups by impersonating Y Combinator through GitHub notifications, leading to financial theft via fake verification schemes.
Attackers registered multiple GitHub accounts and repository names similar to "Y Combinator," such as "ycombinato" and "ycombbinator." These accounts created numerous GitHub issues per minute, tagging random users. Notifications appeared official, mentioning a supposed selection for funding or an authorization process.
Victims received emails and GitHub notifications, sometimes with follow-ups requesting users to verify their wallets or deposit funds for further steps. Attackers deployed GitHub Apps, such as "ycombinatornotify," to increase perceived legitimacy. The scheme utilized GitHub’s notification system and emails, employing automated scripts until repositories were reported and deleted or rate-limited by GitHub.
Notifications appeared official, mentioning a supposed selection for funding or an authorization process.
Victims were redirected from GitHub notifications to phishing domains like "y-comblnator.com." These pages mimicked Y Combinator branding but aimed to collect wallet credentials or request crypto deposits, exploiting promises of startup funding. Domains used typo-squatting tactics to avoid detection.
Despite initial spam repositories being removed, suspicious activity continued with new accounts and repositories. Attackers adapted their approach, launching new campaigns promptly. Affected individuals reported fraudulent domains to phishing protection lists and used API workarounds to remove lingering notification spam in GitHub.
GitHub responded by deleting scam repositories and user accounts. However, phishing notifications and fake domains may persist. This campaign highlights how cybercriminals exploit trusted service notifications and mimic reputable brands. Developers and startup founders should remain vigilant, verify communications directly with organizations, and report suspicious activity promptly.
Based on reporting by GBHackers.