Cybersecurity experts are sounding alarms over a sophisticated phishing tool called GoIssue, designed to execute large-scale email phishing campaigns targeting GitHub users. Marketed on the Runion

Discover your weakest link. Be proactive, not reactive. Cybercriminals need just one flaw to strike.

that GoIssue signifies a “dangerous shift in targeted phishing” that can expose users to severe risks, from source code theft to supply chain attacks and corporate network breaches through compromised developer credentials. Equipped with the extracted email data, threat actors can launch mass phishing campaigns against developer communities, bypassing spam filters and targeting specific recipients.

SlashNext notes that a hypothetical attack scenario using GoIssue could lure victims to fake login pages to steal credentials or redirect them to a malicious OAuth application, potentially granting attackers access to private repositories and sensitive data.

Gitloker Team Connection and Extortion Campaigns

Cyberdluffy, whose Telegram profile identifies him as part of the Gitloker Team, may already have a history of GitHub-centric extortion. Previously, Gitloker was tied to an attack in which GitHub users received messages impersonating GitHub security or recruitment teams to trick them into clicking a malicious link. Upon granting permissions to a fraudulent OAuth application, affected users found their repositories purged, replaced by a ransom demand urging contact with Gitloker on Telegram.

Exploiting GitHub’s Notification System

GoIssue uses GitHub’s automated notification system to scale phishing. Attackers employ compromised GitHub accounts to tag victims in spam comments within random issues or pull requests. These tags trigger legitimate GitHub email notifications, lending credibility to the phishing attempt. The included links lead to counterfeit GitHub pages instructing users to sign in and grant permissions to malicious OAuth apps. Unsuspecting developers who grant permissions unknowingly give attackers access, leading to repository erasure and extortion attempts.

Sophisticated Two-Step Phishing Tactics

Perception Point recently

Are u a security researcher? Or a company that writes articles about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing? If you want to express your idea in an article contact us here for a quote: [email protected]

Source: thehackernews.com