Latest / Logosofia no Dia a Dia
Why Your Next GitHub Notification Could Be a Trap
In this episode, we investigate a sophisticated surge in phishing attacks that are weaponizing the very tools developers trust most. By exploiting GitHub’s notification system—a technique known as "Living off Trusted Services" (LOTS)—attackers are bypassing enterprise security filters to deliver high-pressure "Emergency Action Alerts" directly to user inboxes. We dissect the "stellarwatchmanshow" campaign, which uses fabricated CVEs and academic personas like the "Neural Dynamics Lab" to trick users into downloading malicious patches from third-party sites. From mass-mentions in GitHub…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.