GitHub users targetted by Sawfish phishing campaign

guest · Apr 17, 2020

GitHub users targetted by Sawfish phishing campaign
April 17, 2020
https://nakedsecurity.sophos.com/2020/04/17/github-users-targetted-by-sawfish-phishing-campaign/

GitHub users beware: online criminals have launched a phishing campaign to try and gain access to your accounts.

The Microsoft-owned source code collaboration and version control service reported the campaign, which it calls Sawfish, on Tuesday 14 April. Users were reporting emails that tried to lure them into entering their GitHub credentials on fake sites for a week before, it said.
Most of these domains are already down and the phisher has been swapping them out quickly, GitHub warned.

The phishers appear to be targeting people based on the addresses used for public Git commits. These are updates to source code that are publicly viewable. That could explain one Redditor’s report of a phishing email sent to an address used exclusively for GitHub.
Click to expand...

guest · Jul 21, 2020

DeepSource resets logins after employee falls for Sawfish phishing
July 21, 2020
https://www.bleepingcomputer.com/ne...ns-after-employee-falls-for-sawfish-phishing/

GitHub notified DeepSource earlier this month of detecting malicious activity related to the startup's GitHub app after one of their employees fell victim to the Sawfish phishing campaign.
DeepSource provides developers with automated static code analysis tools for GitHub, GitLab, and Bitbucket repositories that help spot and fix issues during code review.

Sawfish's operators targeted GitHub users starting with April 2020 as part of a series of spearphishing attacks specifically planned out to steal their credentials using phishing landing pages mimicking GitHub's login page.
Click to expand...

DeepSource employee credentials stolen by Sawfish
According to a notification received by DeepSource on the morning of July 11, DeepSource users were making numerous requests from unusual IP addresses which triggered GitHub Security team's attention which started tracking the activity as potentially malicious.

"Unfortunately, GitHub’s privacy policy prevents them from sharing the affected user list with us, so we are disclosing this issue publicly while waiting for GitHub to complete their investigation," DeepSource explained. "Our understanding is GitHub will notify the directly affected users as per their policies."
DeepSource notified all its users via e-mail on the evening of July 20 about this security incident and plans to launch a security bug bounty program to have security researchers investigate its systems for security vulnerabilities.
Click to expand...

Log in or Sign up

GitHub users targetted by Sawfish phishing campaign

guest Guest

guest Guest

Log in or Sign up

GitHub users targetted by Sawfish phishing campaign

guest Guest

guest Guest

Useful Searches