Phishing attack through GitHub notification

4•ghm2199•4mo ago

I got a phishing email from a repo I never subscribed to https://github.com/ycombbiinator/-co

The email looks like so https://pasteboard.co/HYYB7qg0tv2M.png

And I could see I was subscribed to the "issue" https://pasteboard.co/zIj5fcaIhNYA.png

Comments

gnabgib•4mo ago

> The best email address for anything like this is security@ycombinator.com

https://news.ycombinator.com/item?id=45353095

"Discussion" (17 points, 4 hours ago, 17 comments) https://news.ycombinator.com/item?id=45352610

ghm2199•4mo ago

I am sure I never subscribed to this repo. However I came across https://github.blog/changelog/2025-04-14-sunset-notice-for-a...

which possibly means one of the teams I had actually been a part of is the issue.

johntash•4mo ago

I've gotten a few similar spam/phishing notifications from github recently too. It showed that my username was tagged in the issue (along with 10-20 others).

appdata•4mo ago

I haven't gotten a phishing email, but I permanently have `ycombbiinator/-co` in my GitHub Notifications list. It doesn't display any notifications, but I have the blue notification icon. It's so annoying.

https://ibb.co/xKxXrKVL

appdata•4mo ago

Here's a fix to remove the notification. Use the GitHub CLI (cli.github.com) to remove it.

gh auth login

gh api notifications //find the bad phishing notification that should be deleted

gh api --method PATCH notifications/threads/(ID HERE)

Show HN: I decomposed 87 tasks to find where AI agents structurally collapse

I went back to Linux and it was a mistake

Octrafic – open-source AI-assisted API testing from the CLI

US Accuses China of Secret Nuclear Testing

Peacock. A New Programming Language

A postcard arrived: 'If you're reading this I'm dead, and I really liked you'

What to know about the software selloff

Show HN: Syntux – generative UI for websites, not agents

Microsoft appointed a quality czar. He has no direct reports and no budget

AI overlay that reads anything on your screen (invisible to screen capture)

Show HN: Seafloor, be up and running with OpenClaw in 20 seconds

Tesla turbine-inspired structure generates electricity using compressed air

State Department deleting 17 years of tweets (2009-2025); preservation needed

Learning to code, or building side projects with AI help, this one's for you

Effulgence RPG Engine [video]

Five disciplines discovered the same math independently – none of them knew

We Scanned an AI Assistant for Security Issues: 12,465 Vulnerabilities

Amazon no longer defend cloud customers against video patent infringement claims

Show HN: Medinilla – an OCPP compliant .NET back end (partially done)

How Does AI Distribute the Pie? Large Language Models and the Ultimatum Game

Resistance Infrastructure

Fire-juggling unicyclist caught performing on crossing

Restoring a lost 1981 Unix roguelike (protoHack) and preserving Hack 1.0.3

GPS and Time Dilation – Special and General Relativity

Show HN: Witnessd – Prove human authorship via hardware-bound jitter seals

Show HN: I built a clawdbot that texts like your crush

Scientists reverse Alzheimer's in mice and restore memory (2025)

Compiling Prolog to Forth [pdf]

Show HN: Cymatica – an experimental, meditative audiovisual app

GitBlack: Tracing America's Foundation