The “Seal of Approval” Trap: How Hackers are Hijacking GitHub and Jira Notifications

Cisco Talos observed attackers abusing trusted notification systems in collaboration platforms (GitHub and Jira) in a technique called Platform-as-a-Proxy (PaaP), where malicious content is delivered via legitimate platform-generated emails—bypassing SPF/DKIM/DMARC and leveraging organizational trust—to carry out phishing and credential-harvesting scams (e.g., malicious commit messages on GitHub and deceptive Jira invites); defenders are urged to rethink SaaS traffic monitoring as signature-based filtering is insufficient.