Fake GitHub Token Alert: Three Links, One Pages Site

**Phishing campaign impersonating GitHub:** Four staff at a UK consumer fintech received a fake GitHub security notice linking all “remediation” buttons to an attacker-controlled GitHub Pages site (ssomanager.github.io) and sent from a newly registered domain (portalsecure.co.uk) via Mailgun; one recipient reported it, mailboxes were quarantined, no compromise was observed, and IOCs (domains, emails, IPs, subject) are provided.