Hackers Use GitHub Notifications to Impersonate Y Combinator and Steal Wallet Funds
## Cybersecurity: Phishing Attack on Developers via GitHub
Cybersecurity: Phishing Attack on Developers via GitHub
Recently, a sophisticated phishing attack has targeted developers and startups by impersonating Y Combinator through GitHub notifications. This attack involved the creation of false notifications that misled victims into believing they were selected for startup funding, leading to financial theft through fake verification schemes.
Attackers registered multiple GitHub accounts and repositories with names resembling “Y Combinator,” using variations like “ycombinato,” “ycombbinator,” and “yccombinator.” These accounts generated a large number of GitHub issues, tagging numerous users to create the appearance of official communication. Victims received emails and notifications, sometimes requesting users to verify wallets or deposit funds for further proceedings.
In addition, fake GitHub Apps such as “ycombinatornotify” were used to enhance the legitimacy of the messages. The attack leveraged both GitHub’s notification system and emails through automated scripts until the repositories were reported and managed by GitHub.
Recently, a sophisticated phishing attack has targeted developers and startups by impersonating Y Combinator through GitHub notifications.
Victims were often redirected to phishing domains like “y-comblnator.com,” which mimicked Y Combinator branding to collect wallet credentials or request cryptocurrency deposits. These domains were typo-squatted, using slight variations to evade detection. Reports indicated ongoing activity even after initial spam repositories were removed, with new attacks launched continuously.
Many users reported these incidents to the official Y Combinator security team and GitHub’s abuse system. Affected individuals also submitted fraudulent domains to browser and search engine phishing protection lists. GitHub has responded by deleting scam repositories and user accounts, although phishing notifications and fake domains may still persist.
This campaign underscores the increasing exploitation of trusted service notifications by cybercriminals, emphasizing the need for developers and startup founders to remain vigilant, verify communications directly with organizations, and promptly report suspicious activities.
Based on reporting by GBHackers.