Sunday, April 2, 2023
  • Advertise With Us
  • Write For Us
  • Contact Us
  • About Us
  • Editorial Calendar
Download Latest Issue - Free!
The Cyber Express
World Cybercon Middle East
  • MagazineDownload
  • Firewall Daily
    • All
    • Dark Web News
    • Data Breach News
    • Hacking News
    • Ransomware News
    • Vulnerabilities

    Creal Information Stealer Phish Out Cryptocurrency Users

    New Advisory on Thunderbird Vulnerability

    Mozilla Foundation Releases New Advisory on Thunderbird Vulnerability

    Hacktivism

    Hacktivism and The New Age of Cyber Warfare

    3CX

    Global 3CX Telephone App Users at Risk, CEO Blames ‘Upstream Library’

    HACLA Cyber Attack

    Here’s Everything We Know About HACLA Cyber Attack Claimed by LockBit

    Microsoft Bing Search Results

    Microsoft Bing Search Results Altered Through AAD Misconfiguration

    World Data Backup Day

    World Data Backup Day: Are You Doing it Right?

    UK on AI

    UK Government to Go Light on AI Regulation; Musk, Wozniak Call for Six-month Halt on AI

    Spyware Vendor

    Spanish Spyware Vendor’s Product Used to Target UAE Users, Finds Google

  • Essentials
    • All
    • Compliance
    • Governance
    • Policy Updates
    • Regulations
    cybersecurity-education-legislation

    North Dakota Approves Computer Science and Cybersecurity Education Legislation for K-12 Grades

    BreachForums

    FBI Arrests BreachForums Operator ‘Pompompurin’, Slaps Cybercrime Charges

    Cybersecurity Excellence Awards

    Cybersecurity Excellence Awards: Cyble Rated Fastest Growing Cybersecurity Company

    Insider threat mitigation

    Behavioral Psychology, a Boon for Insider Risk Mitigation

    Safer Internet

    International Safer Internet Day: How Safe Are Our Teenagers Online?

    TRAI

    TRAI Asked to Involve MoD in Drafting Big Data Regulations & Policies

    cybersecurity

    Cybersecurity incidents may soon be ‘uninsurable’

    Australia

    Australia Ropes in Tech Veterans to Set Up Cyber Action Plan

    Active Directory

    Prevent Ransomware: Save the Active Directory

    • Regulations
    • Compliance
    • Governance
    • Policy Updates
  • Features
    • Cyber Warfare
    • Espionage
    • Workforce
      • Learning & Development
  • Business News
    • All
    • Appointments
    • Budgets
    • Mergers & Aquisitions
    • Partnerships
    • Press Release
    • Startups
    CISA

    13 Specialists to Join Forces with CISA’s Cybersecurity Advisory Committee

    GISEC Global 2023

    GISEC Global 2023: H.E. Dr Mohamed Hamad Al-Kuwaiti Recognized for Outstanding Contributions in Advancing Global Cybersecurity

    GISEC Global 2023

    GISEC Global 2023: Knowledge Sharing, Collaboration Vital to Fend off Cyberattacks, say Experts

    Call & Contact Center Expo 2023 Las Vegas

    Call & Contact Center Expo 2023 Las Vegas

    Former BookMyShow CTO Mahesh Vandi Chalil

    Cyble Appoints Former BookMyShow CTO Mahesh Vandi Chalil as Chief Product and Technology Officer

    GISEC 2023

    GISEC 2023: Microsoft Highlights Zero Trust Approach and Mixed Reality Policing Tools

    GISEC Global 2023

    GISEC Global 2023: ‘Take the Fight to Cyber Attackers’ Urges UAE Cybersecurity Council Paper

    Cyble in Forbes List

    Cyble Recognized by Forbes as One of America’s Best Startup Employers 2023

    Cybersecurity Excellence Awards

    Cybersecurity Excellence Awards: Cyble Rated Fastest Growing Cybersecurity Company

    • Startups
    • Mergers & Aquisitions
    • Partnerships
    • Appointments
    • Budgets
    • Research
      • Whitepapers
      • Sponsored Content
      • Market Reports
    • Interviews
      • Podcast
  • EventsCyberCon
    •  Cyber Security Webinar
    • World CyberCon Middle East 2023
    • Endorsed Events
No Result
View All Result
The Cyber Express
  • MagazineDownload
  • Firewall Daily
    • All
    • Dark Web News
    • Data Breach News
    • Hacking News
    • Ransomware News
    • Vulnerabilities

    Creal Information Stealer Phish Out Cryptocurrency Users

    New Advisory on Thunderbird Vulnerability

    Mozilla Foundation Releases New Advisory on Thunderbird Vulnerability

    Hacktivism

    Hacktivism and The New Age of Cyber Warfare

    3CX

    Global 3CX Telephone App Users at Risk, CEO Blames ‘Upstream Library’

    HACLA Cyber Attack

    Here’s Everything We Know About HACLA Cyber Attack Claimed by LockBit

    Microsoft Bing Search Results

    Microsoft Bing Search Results Altered Through AAD Misconfiguration

    World Data Backup Day

    World Data Backup Day: Are You Doing it Right?

    UK on AI

    UK Government to Go Light on AI Regulation; Musk, Wozniak Call for Six-month Halt on AI

    Spyware Vendor

    Spanish Spyware Vendor’s Product Used to Target UAE Users, Finds Google

  • Essentials
    • All
    • Compliance
    • Governance
    • Policy Updates
    • Regulations
    cybersecurity-education-legislation

    North Dakota Approves Computer Science and Cybersecurity Education Legislation for K-12 Grades

    BreachForums

    FBI Arrests BreachForums Operator ‘Pompompurin’, Slaps Cybercrime Charges

    Cybersecurity Excellence Awards

    Cybersecurity Excellence Awards: Cyble Rated Fastest Growing Cybersecurity Company

    Insider threat mitigation

    Behavioral Psychology, a Boon for Insider Risk Mitigation

    Safer Internet

    International Safer Internet Day: How Safe Are Our Teenagers Online?

    TRAI

    TRAI Asked to Involve MoD in Drafting Big Data Regulations & Policies

    cybersecurity

    Cybersecurity incidents may soon be ‘uninsurable’

    Australia

    Australia Ropes in Tech Veterans to Set Up Cyber Action Plan

    Active Directory

    Prevent Ransomware: Save the Active Directory

    • Regulations
    • Compliance
    • Governance
    • Policy Updates
  • Features
    • Cyber Warfare
    • Espionage
    • Workforce
      • Learning & Development
  • Business News
    • All
    • Appointments
    • Budgets
    • Mergers & Aquisitions
    • Partnerships
    • Press Release
    • Startups
    CISA

    13 Specialists to Join Forces with CISA’s Cybersecurity Advisory Committee

    GISEC Global 2023

    GISEC Global 2023: H.E. Dr Mohamed Hamad Al-Kuwaiti Recognized for Outstanding Contributions in Advancing Global Cybersecurity

    GISEC Global 2023

    GISEC Global 2023: Knowledge Sharing, Collaboration Vital to Fend off Cyberattacks, say Experts

    Call & Contact Center Expo 2023 Las Vegas

    Call & Contact Center Expo 2023 Las Vegas

    Former BookMyShow CTO Mahesh Vandi Chalil

    Cyble Appoints Former BookMyShow CTO Mahesh Vandi Chalil as Chief Product and Technology Officer

    GISEC 2023

    GISEC 2023: Microsoft Highlights Zero Trust Approach and Mixed Reality Policing Tools

    GISEC Global 2023

    GISEC Global 2023: ‘Take the Fight to Cyber Attackers’ Urges UAE Cybersecurity Council Paper

    Cyble in Forbes List

    Cyble Recognized by Forbes as One of America’s Best Startup Employers 2023

    Cybersecurity Excellence Awards

    Cybersecurity Excellence Awards: Cyble Rated Fastest Growing Cybersecurity Company

    • Startups
    • Mergers & Aquisitions
    • Partnerships
    • Appointments
    • Budgets
    • Research
      • Whitepapers
      • Sponsored Content
      • Market Reports
    • Interviews
      • Podcast
  • EventsCyberCon
    •  Cyber Security Webinar
    • World CyberCon Middle East 2023
    • Endorsed Events
No Result
View All Result
The Cyber Express
No Result
View All Result
Home Firewall Daily

GitHub and CircleCI Users Hit by Phishing Attack

Vishwa Pandagle by Vishwa Pandagle
September 24, 2022
in Firewall Daily, Data Breach News
0
GitHub and CircleCI Users Hit by Phishing Attack
590
SHARES
3.3k
VIEWS
Share on LinkedInShare on Twitter

Hosting service GitHub and software company CircleCI are alerting their users of a phishing scam detected on September 16. As per reports, the scammers are sending emails to GitHub through CircleCI to gather user credentials and two-factor authentication (2FA) codes.

How users are targeted

According to reports, scammers use fake CircleCI emails to convince GitHub users to sign into their accounts to accept the changed terms and privacy policy. The email states that the account holder needs to click on the link to continue using the services.

You might also like

Fake Accounts Are a Bigger Problem Than Businesses Realize

Creal Information Stealer Phish Out Cryptocurrency Users

Mozilla Foundation Releases New Advisory on Thunderbird Vulnerability

Following the attack, GitHub, the internal hosting service for software development, asked its users to stay alert of such scammers, who are trying to steal account credentials and two-factor codes. However, the report added that the users who opted for multi-factor authentication (MFA) and used hardware security keys for multi-factor authentication were not vulnerable to the phishing links that relayed details through reverse proxies.

While GitHub assured in its security alert that the website was not impacted due to the cyberattack, the company added that other organizations might have been compromised. Several users received fake messages stating that their CircleCI sessions had expired, following which they were required to log in again. However, to do the same, they were taken to a hoax GitHub login page.

Some of the phishing domains released in the report are:

circle-ci[.]com

emails-circleci[.]com

circle-cl[.]com

email-circleci[.]com

CircleCI alerts users

CircleCI also posted a security alert last week informing users about the phishing campaign, adding that the company would never ask users to log in to review updates to terms of service. Moreover, the company urged users who might have clicked on the phishing links to change their password and check their systems for any suspicious activities.

What attackers can do after successfully harvesting credentials

Scammers can create GitHub personal access tokens (PATs), authorize OAuth applications, and add SSH keys for continued access to the site, even if the user changes their password. Moreover, they can download content and create new GitHub user accounts that otherwise require management intervention.

The companies have alerted users, but the attacks are still ongoing, leaving many vulnerable. Hence, users have been asked to maintain caution while clicking on links that require their login details.

Share this:

  • Click to share on LinkedIn (Opens in new window)
  • Click to share on Reddit (Opens in new window)
  • Click to share on Twitter (Opens in new window)
  • Click to share on Facebook (Opens in new window)
  • More
  • Click to email a link to a friend (Opens in new window)
  • Click to share on WhatsApp (Opens in new window)

Related

Tags: cyber express newsfake CircleCIGitHubharvest credentialsphishing email scammersThe Cyber Expresstwo-factor authentication (2FA) codes.
Previous Post

BlackCat Ransomware Data Exfiltration Tool Upgraded

Next Post

Researchers Discover Unknown Hacker Group Operating For Years Without Detection

Vishwa Pandagle

Vishwa Pandagle

Vishwa Pandagle is a Technical Writer at The Cyber Express. She writes cybersecurity news related to data breaches, ransomware, phishing, and best practices among others. She also writes about cybersecurity developments and likes interacting with experts in this field. When not working, she likes self-reflecting, meditating, volunteering, and going for long walks.

Related Posts

Fake Accounts
Features

Fake Accounts Are a Bigger Problem Than Businesses Realize

by Editorial
April 2, 2023
Firewall Daily

Creal Information Stealer Phish Out Cryptocurrency Users

by Vishwa Pandagle
April 1, 2023
New Advisory on Thunderbird Vulnerability
Firewall Daily

Mozilla Foundation Releases New Advisory on Thunderbird Vulnerability

by Ashish Khaitan
April 1, 2023
Hacktivism
Firewall Daily

Hacktivism and The New Age of Cyber Warfare

by Editorial
April 1, 2023
3CX
Cybersecurity News

Global 3CX Telephone App Users at Risk, CEO Blames ‘Upstream Library’

by Chandu Gopalakrishnan
March 31, 2023
Next Post
Metador Hacker Group

Researchers Discover Unknown Hacker Group Operating For Years Without Detection

Latest Issue is Out. Subscribe Now

Download Now

CRIL


Follow Us On Google News

Never miss an update. Subscribe!

* indicates required

Top 10 Cybersecurity Jobs

Categories

About The Cyber Express

The Cyber Express

Cyber Security News and Magazine

The Cyber Express is a handbook for all stakeholders of the internet that provides information security professionals with the latest news, updates and knowledge they need to combat cyber threats.

Follow The Cyber Express

Contact

For editorial queries: [email protected]

For marketing and Sales: [email protected]

For Sponsorship/Event Partnership: [email protected]

For Conferences related information: [email protected]

Our Address

We’re remote friendly, with office locations around the world:

San Francisco, Atlanta, Rome,
Dubai, Mumbai, Bangalore, Hyderabad,  Singapore, Jakarta, Sydney, and Melbourne

 

Headquarters:

The Cyber Express LLC
555 North Point Center E
Alpharetta, GA 30022, USA.

Tel: (678) 578-8838

Events: +1 (678) 578-4140

 

India Office:

Cyber Express Media Network
HD-021, 4th Floor, C Wing, Building No.4. Nesco IT Park, WE Highway, Goregaon East, Mumbai, Maharashtra, India – 4000063

Tel: (678) 578-8838

Events: +1 (678) 578-4140

Subscribe to Our Feed

RSS Feeds

Follow Us On Google News

© 2022 The Cyber Express (Cyber Security News and Magazine) | By Cyble Inc.

No Result
View All Result
  • Firewall Daily
  • Business News
  • Cyber Essentials
  • Features
  • Cyber Security Magazine
  • Events
    • World CyberCon Middle East 2023
    •  Cyber Security Webinar

© 2022 The Cyber Express (Cyber Security News and Magazine) | By Cyble Inc.

Welcome Back!

Login to your account below

Forgotten Password?

Retrieve your password

Please enter your username or email address to reset your password.

Log In

Add New Playlist

This website uses cookies. By continuing to use this website you are giving consent to cookies being used. Visit our Privacy and Cookie Policy.