According to the Microsoft-owned company, many of its users have received phishing emails claiming that unauthorized activity has been detected or that a change has been made to their account. The links included in these emails lead to a fake GitHub login page set up to harvest the victim’s username and password and send them to the attackers.
GitHub has pointed out that this phishing campaign has several noteworthy aspects. For example, the phishing page also instructs users who rely on two-factor authentication to protect their account to enter the code generated by their time-based one-time password (TOTP) application. This allows the attackers to hack into accounts protected with this type of system, but the company says users who rely on hardware security keys are not vulnerable.
