Hackers Abuse GitHub and Jira Notifications to Deliver Phishing Through Trusted SaaS Channels

This report describes a phishing campaign that weaponizes legitimate GitHub and Jira automated notifications: attackers embed fraudulent billing/invoice and support content into commit messages or project descriptions so the platforms’ own signed emails deliver convincing phishing messages that bypass SPF/DKIM/DMARC checks and aim to harvest credentials; Cisco Talos observed notable traffic spikes and recommends logging platform API/audit activity, flagging atypical notifications, and directing users to verify directly on the platform.