Gitloker attacks abuse GitHub notifications to push malicious oAuth apps

Threat actors are running an ongoing GitHub-targeted extortion campaign that uses compromised accounts and spam mentions to deliver phishing emails impersonating GitHub; victims are redirected to malicious domains that request OAuth authorization granting broad repository and data access. Attackers use obtained access to wipe and rename repositories, leave ransom notes directing victims to Telegram, and claim data theft, causing account disablement and loss of repository data for dozens of developers.