Hackers Abuse GitHub Issue Notifications to Phish Developers Through Malicious OAuth Apps

**Researchers uncovered a developer-targeted phishing campaign that leverages GitHub’s issue notification system and a TOCTOU race condition to send polished OAuth authorization links from GitHub no-reply emails.** Attackers create fake accounts and OAuth apps requesting broad repository and Actions permissions, mention targets in issues to trigger notifications, then rapidly edit or delete the issue so the email contains the malicious content while the repository shows no trace. If authorized, attackers can obtain access tokens to clone, modify, or backdoor code and interact with automation workflows, posing a supply-chain and account compromise risk; the report includes recommended defensive actions such as auditing OAuth apps, reviewing permissions, and restricting mentions in issues.