In March 2025, attackers opened GitHub issues posing as a security alert so that GitHub's own notification emails would reach maintainers. The links led to a malicious OAuth app. The lesson for developers: the email came from a trusted sender, and the danger was the permission screen.
What was reported
Help Net Security reported that the emails appeared to come from the GitHub Security Team and warned of an unusual access attempt from a device in Reykjavik, Iceland. The attackers created a GitHub issue containing the fake alert and relied on GitHub's automatic notifications to email project maintainers. They rotated through several GitHub accounts to create the issues, because GitHub shut the accounts down after targets reported them.
The OAuth app was named gitsecurityapp and was presented as a helper for securing the account. According to the article, it could access public and private repositories, profile information and discussions, modify GitHub Actions workflow files and delete repositories. The article says the attackers' actual use of the access is unknown.
I am not repeating figures for how many accounts or repositories were affected, because reports differed.
Why it was convincing
The delivery path was real. A notification from a genuine service reached the inbox, so sender checks and spam filters had little to object to. The message also created urgency with a location and a security story.
The page the link opened was the real OAuth consent screen. The attack worked only if the person approved the permissions.
How to protect yourself
Treat any security alert that asks you to authorize an app as suspect. Go to GitHub by typing the address, then review Settings and Security there.
Read the permissions on every consent screen. An app that offers to secure your account has no reason to ask to edit workflows or delete repositories.
Review your authorized apps. GitHub's steps are Settings, Applications, then the Authorized OAuth Apps tab, where you can revoke apps you do not recognize. Revoking removes the app's token.
If you authorized the app
Per the article:
- Remove the app's access from your account.
- Change your login credentials and rotate authorization tokens.
- Review your repositories for unauthorized additions or changes, and delete any you find.
Also check workflow files, since the app could modify them, and look for new tokens or deploy keys. See consent phishing and OAuth review for the general method.
What defenders and teams can add
Maintainers of larger projects can put a short note in their contributing guide: security alerts about your account will never arrive as an issue comment, and nobody on the project will ask you to authorize an app through a link. Staff who run organization accounts can restrict which OAuth apps are allowed at organization level, so a single click cannot grant access to organization data. Say this in onboarding, because the first time someone sees a consent screen should not be during an attack.
Quick check
Could a spam filter have caught this?
Probably not by sender reputation, since the mail came through GitHub's real notification system. Permission review and user caution are the main defense.
Is 2FA enough to protect against this?
No. The user is granting access to an app, so a second factor is not part of the flow. Revoke the app.
Sources
- GitHub project maintainers targeted with fake security alert (Help Net Security)
- Reviewing your authorized OAuth apps (GitHub Docs)
Last reviewed: 19 October 2026.
