Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mass phishing emails pretending to be Y Combinator right now

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 34 posts

Mass phishing emails pretending to be Y Combinator right now

#1

Post by Tremeschin »

Just received quite a smart phishing email/notification coming from "GitHub" by a user created less than a week ago (1) which is currently creating multiple issues a minute tagging many random usernames in a repository (2) with a "ycombinatornotify" app (3). The usual - asking to verify wallets, deposit for authorization as I've been selected for funding, etc. All issues contains the content of the email received, so I'll not paste them here (they're gone, but still, a bad idea to paste it).

- (3m in) They seem to have been rate limited or reached a target of 500 issues

- (5m in) Repository was just taken down, hope they automate back a warning

- They have typo-squatted the "y-comb[l]nator [dot] com" domain (with hyphen and L)

Quite urgent actions are needed to stop it, or warn the affected. Will update the submission with more information as time goes.

- [1]: https://github.com/ycombinato/

- [2]: https://github.com/ycombinato/rorg/

- [3]: https://github.com/apps/ycombinatornotify

Re: Mass phishing emails pretending to be Y Combinator right now

#3

Post by Bender »

Be sure to email this to Daniel dang hn@ycombinator.com and flag the email as high priority. Be sure to include all the email headers.

Also report it to github [1] and the Feds [2] in the off chance someone takes it seriously. Be sure to include all the email headers here too.

[1] - https://docs.github.com/en/communities/maintaining-your-safe...

[2] - https://www.ic3.gov/

Re: Mass phishing emails pretending to be Y Combinator right now

#4

Post by Tremeschin »

Bender wrote: post #3

Be sure to email this to Daniel dang hn@ycombinator.com and flag the email as high priority. Be sure to include all the email headers. Also report it to github [1] and the Feds [2] in the off chance someone takes it seriously. Be sure to include all the email headers here too. [1] - https://docs.github.com/en/communities/maintaining-your-safe... [2] - https://www.ic3.gov/

Thanks! Just wrote them a warning and forwared the original message.

Re: Mass phishing emails pretending to be Y Combinator right now

#5

Post by tomhow »

Thanks, we're getting a lot of emails about this to hn@ycombinator.com.

The best email address for anything like this is security@ycombinator.com, as they handle security issues for all of YC, including applications.

Thanks everyone for letting us know about this.

Re: Mass phishing emails pretending to be Y Combinator right now

#7

Post by tomhow »

Bender wrote: post #3

Be sure to email this to Daniel dang hn@ycombinator.com and flag the email as high priority. Be sure to include all the email headers. Also report it to github [1] and the Feds [2] in the off chance someone takes it seriously. Be sure to include all the email headers here too. [1] - https://docs.github.com/en/communities/maintaining-your-safe... [2] - https://www.ic3.gov/

Thanks, but it's a YC security issue not an HN/dang issue – security@ycombinator.com!

Re: Mass phishing emails pretending to be Y Combinator right now

#8

Post by rolph »

tomhow wrote: post #6
rolph wrote: post #2

you should email hn@ycombinator.com attn: Dang

Thanks, but it's a YC security issue not an HN/dang issue – security@ycombinator.com!

it seems that i have very recently aquired some new links in my footer, one of them is what your mentioning.

either its something i have changed on this particular agent, somthing changed on HN, or a newly aquired feat due to accumulated X.P.

thanx for pointing at it.

Re: Mass phishing emails pretending to be Y Combinator right now

#9

Post by Tremeschin »

And another round of mass user tagging at a 'gitcoin-org' username, same message vibe, stopped at 500 issues. This is now a GitHub's duty I assume. Potentially more, I see a couple different names on r/github. Yup, via https://github.com/orgs/community/discussions/174283
Post reply on HN