Phishers Exploit GitHub and Jira Email Delivery System Vulnerabilities

Post Views: 14

Sophisticated Phishing Campaign Exploits SaaS Platforms

Cisco Talos researchers have identified a sophisticated phishing campaign that targets software-as-a-service (SaaS) platforms like GitHub and Jira. The attackers utilize these platforms’ own infrastructure to send phishing and spam emails, thus evading traditional security measures.

Exploiting Features of SaaS Platforms

The malicious actors take advantage of features offered by these platforms, such as GitHub’s notification system triggered by repository activity and Jira’s Invite Customers feature. By utilizing these functionalities, they can craft convincing messages that appear to originate from the platform itself, complete with legitimate branding and formatting.

"The attackers leverage these platforms’ own infrastructure to send phishing and spam emails, thereby evading traditional security measures." – Cisco Talos researchers

GitHub and Jira Being Exploited

On GitHub, the attackers push a commit on an existing project, which triggers an automatic notification to all collaborators. This notification includes a short summary and a longer description. The short summary serves as a hook to grab the user’s attention, while the longer description contains the actual phishing content, such as fake billing details or malicious links.
Jira is also being exploited in a similar manner. Attackers use the Invite Customers feature to send phishing emails that will bypass security protections. They enter victim email addresses, and Atlassian’s backend assembles the message by injecting the attacker’s field values into its own trusted template.

"The inclusion of malicious content in fields such as the welcome message or project description ensures that it is automatically included in system-generated emails. Moreover, because the malicious message is sent within Atlassian’s cryptographically signed templates, it is less likely to be flagged by security solutions." – Cisco Talos researchers

Conclusion

These tactics demonstrate the ingenuity of attackers in exploiting SaaS platforms’ features to evade security measures. As a result, organizations must remain vigilant and implement robust security protocols to mitigate these types of threats.