GitHub and Jira Alerts Hijacked for Trusted-SaaS Phishing

Cisco Talos documents a Platform‑as‑a‑Proxy (PaaP) phishing technique where attackers embed malicious lures into legitimate GitHub commit notifications and Jira service/invite emails. Because these messages are sent and cryptographically signed by the SaaS providers, they pass SPF/DKIM/DMARC checks and inherit provider reputation, enabling large‑scale credential harvesting and invoice fraud campaigns. Observations include measurable percentages of abused messages and recommendations to ingest SaaS API logs, apply identity‑level allowlists, adopt Zero‑Trust for SaaS notifications, and add friction/takedown automation to reduce attacker effectiveness.