Yesterday at 09:09

New Phishing Tool GoIssue Uses Bulk Email Campaigns to Attack GitHub Developers

Cybersecurity experts are highlighting a newly advanced tool named GoIssue, capable of deploying phishing messages at scale, specifically aimed at GitHub users.

Initially promoted by a threat actor known as cyberdluffy (also referred to as Cyber D’ Luffy) on the Runion forum in early August, the tool is advertised as enabling cybercriminals to gather email addresses from public GitHub profiles and send bulk messages directly to user inboxes.

“Whether you’re looking to connect with a targeted audience or broaden your reach, GoIssue delivers the precision and impact you require,” the threat actor stated in their announcement. “GoIssue can dispatch bulk emails to GitHub users, reaching their inboxes and targeting any desired recipient.”

SlashNext described the tool as a “concerning advancement in targeted phishing,” one that may facilitate access to source code theft, supply chain attacks, and breaches into corporate networks by exploiting developer credentials.

“Equipped with this data, attackers can execute tailored mass email campaigns engineered to bypass spam filters and engage specific developer groups,” the company stated.

A custom version of GoIssue is priced at $700, while full access to its source code is available for $3,000. However, as of October 11, 2024, discounts have reduced these prices to $150 for the custom build and $1,000 for the complete source code for “the first 5 buyers.”

In a potential attack scenario, a threat actor might use this tool to direct victims to fraudulent pages designed to capture login details, install malware, or authorize a deceptive OAuth app requesting access to their private repositories and data.

Another noteworthy aspect of cyberdluffy’s online presence is their Telegram profile, where they claim to be a “member of the Gitloker Team.” Gitloker was previously linked to a GitHub-specific extortion scheme that involved deceiving users into clicking on a malicious link by posing as GitHub’s security or recruitment teams.

The links are embedded in email notifications automatically sent by GitHub after developer accounts are tagged in spam comments on open issues or pull requests, using already compromised accounts. These fraudulent pages prompt recipients to log into their GitHub accounts and authorize a new OAuth application under the guise of applying for new job opportunities.

If an unwary developer grants all permissions to the malicious OAuth app, the attackers proceed to wipe all repository contents, replacing them with a ransom note instructing the victim to reach out to a persona called Gitloker on Telegram.

“GoIssue’s capacity to dispatch these targeted emails at scale enables attackers to expand their campaigns, potentially affecting thousands of developers simultaneously,” SlashNext reported. “This escalates the threat of successful breaches, data exfiltration, and compromised projects.”

This development coincides with Perception Point’s discovery of a new two-step phishing method using Microsoft Visio (.vsdx) files and SharePoint to steal credentials. The emails, disguised as business proposals, originate from previously compromised accounts to evade authentication filters.

“Clicking on the URL provided in the email body or within the attached .eml file directs the recipient to a Microsoft SharePoint page containing a Visio (.vsdx) file,” the company reported. “The SharePoint account used to host the Visio files is often compromised as well.”

Inside the Visio file is another clickable link that ultimately redirects the user to a counterfeit Microsoft 365 login page aimed at stealing credentials.

“Two-step phishing attacks using trusted platforms and familiar file formats like SharePoint and Visio are becoming more prevalent,” Perception Point added. “These sophisticated evasion tactics leverage user confidence in recognized tools while avoiding detection by conventional email security systems.”

Source: TheHackerNews