Season 2 · Episode 1549
Why Your Next GitHub Notification Could Be a Trap
Attackers are weaponizing GitHub notifications to bypass security filters. Learn how to spot the latest phishing lures before you click.
My Weird Prompts · Daniel Rosehill
March 25, 202617m 56s
Audio is streamed directly from the publisher (dts.podtrac.com) as published in their RSS feed. Play Podcasts does not host this file. Rights-holders can request removal through the copyright & takedown page.
Show Notes
In this episode, we investigate a sophisticated surge in phishing attacks that are weaponizing the very tools developers trust most. By exploiting GitHub’s notification system—a technique known as "Living off Trusted Services" (LOTS)—attackers are bypassing enterprise security filters to deliver high-pressure "Emergency Action Alerts" directly to user inboxes. We dissect the "stellarwatchmanshow" campaign, which uses fabricated CVEs and academic personas like the "Neural Dynamics Lab" to trick users into downloading malicious patches from third-party sites. From mass-mentions in GitHub Discussions to the compromise of nearly 12,000 repositories in a single week, this episode explores the industrial scale of modern social engineering. We also discuss the ultimate goal of these strikes: harvesting "Secret Zero" credentials to poison the software supply chain. Learn the essential red flags to watch for and how to update your security playbook for an era where a "trusted sender" is no longer enough to guarantee safety.