GitHub Scam Alert: Protecting Users from Job Scams.

[mrrajputhacker]

⚠️ Scam Alert: Fake GitHub Job Opportunity Email.

Developer Receiving a scam email From GitHub, falsely claiming selection for a job.

Scammers exploiting mention notifications in issue threads. Always double-check suspicious emails.

The link's domain is similar but not identical to GitHub's official site, requesting access to private repositories. Beware! Fake web: auth.githubtalentcommunity.online (do not authorize).

⚠️ Developers or any GitHub users should also check if their thread subscribe email is leaking anywhere because if attackers get that email, they are also able to make comments on your company repository.

GitHub - Unauthorized user's reply to repository communication on behalf of other users.

Requirement :-
Target@reply.github.com
( This is the domain of the email address, indicating that it is associated with GitHub's reply-by-email system. )

After finding the @reply.github.com email of the target, Attacker proceed to a fake mailer website to comment on the repository on behalf of that company's employee.

Read more - Tweet

[ettaboyle]

We understand the inconvenience caused by these notifications. Our teams are currently working on addressing these unsolicited phishing notifications. We want to remind our users to continue to use our abuse reporting tools to raise any abusive or suspicious activity.

We would like to bring to our users’ attention to the following:

• Please do not click any links or reply to these notifications. Please report them.
• Authorizing an OAuth app can expose your GitHub account and data to a third party.  
• GitHub’s recruitment process would never mention its users via issues/PRs or other public content.
• GitHub recommends you periodically review your authorized OAuth apps. 
  This spam activity targets and abuses GitHub’s mention and notification functionality.
• This is a phishing campaign and is not the result of a compromise of GitHub or its systems.

[Nagimesi]

https://github.com/ecommerce-shop/eco-wallet is a blockchain job scam repo too.