Tell HN: Phishing campaign claiming to be GitHub Developer Fund

#1

Post by bobbiechen » Sat, Sep 20, 2025, 12:41 AM UTC

Just spotted this phishing campaign using GitHub issues to send convincing emails.

Look at this issue and the others in this repo: https://github.com/gitcoinco-n/gitcoin/issues/1 (already reported via GitHub report abuse form)

Every messaging interface will be used for scams, unfortunately.

Re: Tell HN: Phishing campaign claiming to be GitHub Developer Fund

#2

Post by maxwellg » Sat, Sep 20, 2025, 12:44 AM UTC

The innocuous https://grants.github.com/apply URL goes to a completely different site. Sneaky sneaky.

Re: Tell HN: Phishing campaign claiming to be GitHub Developer Fund

#3

Post by esafak » Sat, Sep 20, 2025, 1:32 AM UTC

Reported. Let's see how long it takes to get nuked.

Re: Tell HN: Phishing campaign claiming to be GitHub Developer Fund

#4

Post by CM30 » Sat, Sep 20, 2025, 10:17 AM UTC

Seems like it's been taken down now, as have all URLs used for this scam. Hopefully it took less than 8 hours to do this, but hey, at least GitHub eventually did something.

Re: Tell HN: Phishing campaign claiming to be GitHub Developer Fund

#5

Post by sgerrand » Sun, Sep 21, 2025, 9:15 PM UTC

The latest repository being used and advised for this attack is https://github.com/notification-on/gitcoin.com.

Re: Tell HN: Phishing campaign claiming to be GitHub Developer Fund

#6

Post by Master_Odin » Sun, Sep 21, 2025, 9:20 PM UTC

sgerrand wrote: post #5

The latest repository being used and advised for this attack is https://github.com/notification-on/gitcoin.com .

And also https://github.com/notify-hub-co/gitcoin.com.

Re: Tell HN: Phishing campaign claiming to be GitHub Developer Fund

#7

Post by zkitty » Sun, Sep 21, 2025, 11:15 PM UTC

I received this email too. The page title was "Gitcoin | $15M Github Developer Fund 2025 (Issue #225)". The application link is https://gitcoin-developers.com. Obviously copied site from https://gitcoin.co Full email is here. https://jumpshare.com/s/p7Nk2sioWJDZpRjhFutY

Re: Tell HN: Phishing campaign claiming to be GitHub Developer Fund

#8

Post by adamschwartz » Mon, Sep 22, 2025, 4:45 AM UTC

Master_Odin wrote: post #6

sgerrand wrote: post #5

The latest repository being used and advised for this attack is https://github.com/notification-on/gitcoin.com .

And also https://github.com/notify-hub-co/gitcoin.com .

And now https://github.com/notify-chains/gitcoin.com :(

Re: Tell HN: Phishing campaign claiming to be GitHub Developer Fund

#9

Post by freakynit » Mon, Sep 22, 2025, 9:36 AM UTC

I have received 2 of these in 24 hours. The repos are gone by the next day.

Re: Tell HN: Phishing campaign claiming to be GitHub Developer Fund

#10

Post by Aldipower » Mon, Sep 22, 2025, 12:47 PM UTC

I have a stale GitHub notification dot now, after they removed this dodgy repository. Damn GitHub is getting so slow and buggy noawdays.