Comment by theamk

If this was within my first year of owning a GitHub account, I would absolutely fall for this.

It's not much different from setting up your ssh key - something that you have to do; and new users also go through this workflow by copy pasting commands that GitHub sends them.

It’s a numbers game.

Nobody is perfect. The more features of credibility, most likely there will be a higher percentage of conversions. But not everybody has excellent vision, is not time-pressured, and is not tired/exhausted.

There are lots of conditions that make otherwise difficult fraud targets more easy to trick.

And if it can be done at large scale / automated, then small conversion rates turn into many successful frauds (compromised accounts).

A few weeks ago someone opened an issue in one of my repos. In under a minute two accounts replied with links to file lockers asking the user to download and try some software to solve their issue. No doubt it was malware. I promptly deleted the comments and reported the accounts to GitHub.

I wouldn’t have fallen for such an obvious ploy, but the original asker seemed like they weren’t particularly technical, judging by the sparse GitHub history and quality of the question. I could see them perhaps falling for that if they were uncritical and too eager to try anything.

Email from a different domain is unfortunately quite common. Citi and PayPal both do it for some emails. Pisses me off every time.

> Red flag #1: email links to a variation of real domain

It's too common, MS also does this, to be a red flag

I can understand clicking on the link while not paying attention, but I do wonder how many people who are signed up on GitHub would follow through with pasting this command. I could understand if elderly non technical people might follow up with it, but this one, I wonder what the rate is.

Not only does it ask you to copy and paste a command in shell, but Windows apparently warns you that it will run with admin privileges.

Aside from that:

> Nowhere in the email does it say that this is a new issue that has been created, which gives the attacker all the power to establish whatever context they want for this message.

What about the non-user-controlled "(Issue #1)" in the subject line?

Just to let you know, even github themselves use multiple domains instead of just subdomains of github.com (see githubnext.com).

So, I wouldn't blame the victims here if the service itself does not realize why that is not such a good idea.

Everyone has been trained for years to do this:

curl http://obscure.url?random-string | sh

re #1: the email could link to a github pages site hosting the same malware...

re #2: it doesn't really have you typing into shell, 'just paste'

Honestly i would have typed commands in shell if "captcha" asked me for it. Just to see the scale of outcome's awfulness.

I'm almost bored enough to just start installing weird malware for research and funsies