Fake GitHub Security Alerts Delivered Through Issues
Five targeted issue notifications impersonating GitHub Security; shortened-link destinations remain unresolved.
Cristian Chiriac
- Published:
- 2 November 2026
- Version:
- 1.0
- Last observed:
- 30 October 2026
- Dataset frozen:
- 1 November 2026
- Collection cut-off:
- 31 October 2026, 17:59 UTC
- Tracked items rechecked:
- 1 November 2026, 18:23 UTC
- Time zone
- All dates UTC.
Contents
Issues in a sender-controlled repository impersonate GitHub security alerts and mention one target each.
The research in 30 seconds
- What I found
- Issues in a sender-controlled repository impersonate GitHub security alerts and mention one target each.
- What this adds
- This observed set documents a 2026 use of the template through an own-repository notification path, rather than a broad campaign count.
- Verified scope
- Five issues from one account on 28 October; all five remained open at the 29 October check.
- What remains unknown
- Shortened URLs were not resolved. Credential harvesting, an OAuth destination and victim clicks are not established.
The numbers, with their boundaries
Context · separate measure
5
Observed alert issues
28 Oct 2026, 11:51–12:40 UTC · UTC
- Counts:
- One sending account; one user mentioned per issue. Not evidence of a platform-wide campaign.
Earlier snapshot or subset
5 / 5
Still-open issues
29 Oct 2026 · UTC
- Counts:
- Point-in-time recheck of the same five issues.
On 28 October 2026, between 11:51 and 12:40 UTC, one GitHub account opened five issues titled "[GitHub] Critical: Unusual Access Attempt on Your Account" in its own repository. Each issue mentions exactly one user, so GitHub itself sends that user a notification, often by email.
- Each issue carries its own shortened link next to a genuine
support.github.comlink. - The issue numbers reach 31, but only these five are visible.
- All five were still open on 29 October 2026.
This is a small finding: one account and five targets. I did not follow the links, so where they lead is unknown. The targets are not named.
Where this stands (1 November 2026)
#The proven set was closed on 1 November 2026 with what had been found up to 31 October 2026, 17:59 UTC; repositories found after that are tracked separately and are not in these figures. The full proof pass at pinned commits ran on 30–31 October. On 1 November 2026, 18:23 UTC a read-only GitHub API recheck covered the 162 repositories, 73 accounts and 12 issues that are tracked one by one (operator repositories, Shai-Hulud accounts, phishing issues), not the whole set.
- Not counted: the links were not followed, so the issues are a phishing lure, not proven malware.
- State: five of the six issues were still open on 1 November and the posting account was still active; one issue was deleted.
Key findings
#Scope and method
#Expand technical detail · complete record
| Step | What was done | Scope | Date (UTC) | Coverage limit |
|---|---|---|---|---|
| 1. Issue search | Nine lure phrases, monthly slices | 9,175 issues and pull requests, about ten months | to 29 Oct 2026 | Differently worded lures are missed |
| 2. Triage | Automated tools and genuine discussion removed by hand | — | 29 Oct 2026 | Manual |
| 3. Recheck | Open issues and their creation times | 1 repository | 29 Oct 2026, 07:38 | Point in time |
| 4. Screenshots | Issue list and one issue, logged out, from an isolated VM | 2 pages | 29 Oct 2026, 08:16–08:20 | — |
The nine phrases ranged from "github sponsors" "claim" (5,013 hits) and "action required" in titles (1,680) to "security alert" "unusual access" (157).
How the lure works
#- 01Issue in the sender's own repositoryT1566.003Title "[GitHub] Critical: Unusual Access Attempt on Your Account"
- 02One @-mention per issueGitHub notifies the mentioned user, often by email from github.com
- 03Fake alert bodyT1036.005Signed "GitHub Security Team"; unrecognized sign-in; fake review reference
- 04Unique short linkT1204.001u[.]to link per target next to a real support.github.com link; destination not resolved
| Detail | Observed |
|---|---|
| Issues | #26, #27, #28, #30, #31 |
| Created (28 Oct 2026, UTC) | 11:51:08, 11:52:53, 11:53:49, 12:24:34, 12:40:51 |
| Comments | 0 on each at collection |
| Sending account | Created 11 May 2025 |
| Repositories | The issue repository (created 21 Oct 2026) and an empty one (22 Oct 2026) |
| Missing numbers | #1–#25 and #29 not visible |
The same title was used in a large campaign in March 2025, in which issues on about 12,000 repositories led to a malicious OAuth app [1]. This set differs: one repository of its own, one mention per issue, and shortened links. Whether it is the same actor is not established.
ATT&CK mapping
#Expand technical detail · complete record
| Technique | Name | Tactic | Evidence |
|---|---|---|---|
| T1566.003 | Spearphishing via Service | Initial Access | Issue mentions make GitHub deliver the lure to each target (observed) |
| T1036.005 | Match Legitimate Resource Name or Location | Stealth | Message styled and signed as a GitHub security alert (observed) |
| T1204.001 | Malicious Link | Execution | A unique short link per target (observed; destination not resolved) |
Evidence register
#Expand technical detail · complete record
Titles, creation times, mentions and link hosts of the five open issues; repository and account creation dates; logged-out screenshots of the list and one issue.
Source: GitHub issue search, GraphQL and screenshots · Collected 29 October 2026
Confidence and alternative explanations
#| Inference | Confidence | Alternative explanation | Why it is less likely |
|---|---|---|---|
| Phishing intent | High | A security awareness test | No organization or disclosure; real users targeted; per-target tracking links |
| 26 earlier lures existed | Low | Pull requests, spam-hidden or transferred items | Issue and pull-request numbers are shared |
| Same actor as March 2025 | Low | A copy of a public template | Different delivery and link type |
Timeline
#Large fake "Unusual Access Attempt" campaign reported
Sending account created
Issue repository created
Second, empty repository created
Five phishing issues opened
11:51–12:40 UTC
All five still open
Data notes and reconciliation
#Expand technical detail · complete record
| Item | Values seen | Explanation |
|---|---|---|
| Lure phrases searched | 11 vs 9 | Earlier notes say 11; the data file holds 9 distinct queries |
| A template test with a placeholder bit[.]ly link (July 2026) | 1 | Not counted |
Defensive checks
#- GitHub does not send security alerts as issues in other people's repositories. A notification that comes from an issue in an unknown repository is not a security alert, even though it arrives from github.com.
- A URL shortener in a "GitHub Security" message is a red flag. A genuine GitHub link next to it does not make it genuine.
- If you clicked, review Settings → Applications (authorized OAuth apps), your sessions, SSH keys and personal access tokens.
- For the platform: a new repository, security-alert wording, a single mention and a unique short link per issue form a simple pattern.
Indicators
#Expand technical detail · complete record
- Issue title:
[GitHub] Critical: Unusual Access Attempt on Your Account - Body signed "GitHub Security Team", with a "Review Account Activity" button
- A unique
u[.]toshort link per issue next to a genuinesupport[.]github[.]comlink
| Type | Value | Context | Copy | |
|---|---|---|---|---|
| other | git-commit-review | GitHub user created 2025-05-11, live on 2 November 2026. Opened 5 fake GitHub security alert issues in its own repository on 28 October 2026 Confidence: High-confidence suspicious | ||
| repository | git-commit-review/f | Repository holding the issues Confidence: High-confidence suspicious |
What was already public
#Expand technical detail · complete record
Sources were read on or before 29 October 2026. Each one also links to its Internet Archive record, which lists the captures that exist, in case the original moves or changes.
- Help Net Security, fake security alerts targeting GitHub project maintainers (17 March 2025): https://www.helpnetsecurity.com/2025/03/17/github-project-maintainers-targeted-with-fake-security-alert (Internet Archive lookup)
- TechRadar, fake GitHub security alerts and account hijacking: https://www.techradar.com/pro/security/these-fake-github-security-alerts-could-actually-let-hackers-hijack-your-account (Internet Archive lookup)
Not found in the reports I read, as of 29 October 2026: a 2026 use of this template, or this delivery through an own repository with one mention and a unique short link per target.
Limitations
#- One account and five issues; not evidence of a large campaign.
- The short links were not resolved, so the destination, the type of phishing and any clicks are unknown.
- Deleted items cannot be enumerated.
- Lures worded differently from the nine searched phrases would be missed.
Investigation context
#This article is part of the GitHub threat investigation. Counts are a snapshot, not evidence that the code ran on a victim's machine. The shared methodology and proof rules explain inclusion, exclusions and the independent re-check.
Claims, evidence and limits
| Claim | Assessment | Evidence | Limit |
|---|---|---|---|
| Issues impersonating a GitHub security alert | Confidence: Confirmed malicious | E-PH-ISSUES | Not stated in the finding |
| The link destination is unknown | Confidence: Unconfirmed | E-PH-ISSUES | Not stated in the finding |
Terms used on this page
- pinned commit
- A specific commit, identified by its hash, at which a repository was read. Every counted repository was proven at the default-branch commit recorded in the proof pass, so a later change to the repository does not change what was proven.
- proof pass
- The 30–31 October 2026 re-read of every candidate at a pinned commit under fixed inclusion rules, followed by an independent re-read of a random sample of 555 repositories through a different API.
All terms: glossary.
Corrections & discussion
Found an error, or have evidence that supports or contradicts a finding? Send a correction. Name the section and what you observed.