‼️ just got a pretty smart github OAuth phishing/ATO attempt on my personal account. attacker created a repo named after my github username, opened an issue mentioning me with a fake account-access alert, which triggered a real email from [email protected]. “This wasn’t me” → attacker-controlled GitHub Pages → real github.com OAuth consent page for an app called “profile security settings”, asking for public/private repo access + permission to update GitHub Actions workflow files. no fake github login page. the email is github, the auth page is github. the malicious part is the OAuth app + redirect flow. the page is just an obfuscated redirector, while the OAuth callback forwards the returned code/state to the same backend: github.com/api6268/code-839c… also caught two other username-specific phishing issues from the same github account before they disappeared. some indicators: issue account: 6119f4f OAuth app: profile security settings consent: Authorize request-6286 landing: api6268[.]github[.]io/code-839c74ee/ related landing: api25cd[.]github[.]io/account-13e95c92/ callback: request-6286[.]github[.]io backend: gitmain[.]serveblog[.]net route ID: 9e52a992