Gitloker attacks abuse GitHub notifications to push malicious OAuth apps
Attackers use fake GitHub notifications to trick users into authorizing malicious OAuth apps that steal repo access.
- from
- CI/CD Attacks
- added
- 2026-10-10
- likes
- 0
similar
-
Security alert: social engineering campaign targets technology industry employees github.blog
Phishing GitHub users to download and execute repositories.
-
GitHub comments abused to push malware via Microsoft repo URLs bleepingcomputer.com
Hidden GitHub comment link.
-
Forging signed commits on GitHub iter.ca
A bug in GitHub's API allowed forging signed commits. By exploiting a regex flaw in an internal Codespaces API endpoint, an attacker could create commits signed by any user, despite GitHub's web flow signature.
-
-
-
Hijacking GitHub runners to compromise the organization synacktiv.com
Registering a GitHub runner with the ubuntu-latest tag grants access to jobs originally designated for GitHub-provisioned runners.
CI/CD Attacks › Techniques > Initial Code Execution: “Attackers use fake GitHub notifications to trick users into authorizing malicious OAuth apps that steal repo access.”