GitPhish – A New Tool that Automates GitHub Device Code Phishing Attack

This report introduces GitPhish, an open-source tool that automates GitHub Device Code phishing by dynamically generating device codes on demand and deploying professional landing pages via GitHub Pages, thus removing the typical 15-minute timing constraint and enabling scalable multi-target operations. Aimed at security teams and red teamers, it provides CLI and web dashboard workflows with logging and token management to support realistic assessments and detection validation around OAuth device flows targeting developer infrastructure and CI/CD pipelines.