Mass phishing emails pretending to be Y Combinator right now

[Tremeschin]

Just received quite a smart phishing email/notification coming from "GitHub" by a user created less than a week ago (1) which is currently creating multiple issues a minute tagging many random usernames in a repository (2) with a "ycombinatornotify" app (3). The usual - asking to verify wallets, deposit for authorization as I've been selected for funding, etc. All issues contains the content of the email received, so I'll not paste them here (they're gone, but still, a bad idea to paste it).

- (3m in) They seem to have been rate limited or reached a target of 500 issues

- (5m in) Repository was just taken down, hope they automate back a warning

- They have typo-squatted the "y-comb[l]nator [dot] com" domain (with hyphen and L)

Quite urgent actions are needed to stop it, or warn the affected. Will update the submission with more information as time goes.

- [1]: https://github.com/ycombinato/

- [2]: https://github.com/ycombinato/rorg/

- [3]: https://github.com/apps/ycombinatornotify

[tomhow]

Thanks, we're getting a lot of emails about this to [email protected].

The best email address for anything like this is [email protected], as they handle security issues for all of YC, including applications.

Thanks everyone for letting us know about this.

[britta]

For anyone at GitHub looking at this thread: please update your documentation page about how to report abuse (https://docs.github.com/en/communities/maintaining-your-safe...). I tried to follow the instructions, but I ran into a bunch of dead ends that slowed me down - I couldn't find the report abuse buttons for issues, comments, or repositories, only for the user profile page. I'm on Chrome on a Mac laptop, logged into GitHub.

Also, on the report abuse page that I got to from the user profile page, the green submit button is nearly hidden by the grey footer, even when I scroll the page around and complete the captcha.

[e1g]

To remove resulting notifications, see instructions here https://github.com/orgs/community/discussions/174283#discuss...

These spam repositories have been deleted, but I still had lingering notifications stuck on GitHub, and I couldn't see them in the UI to remove them (but the small blue notification dot was constantly on). The API hack resolved this problem.

[jakesomething]

Came here looking for this. Thank you - removed the annoying blue notification now.

[gbrayut]

Worth reporting the phishing domain(s) so they can potentially be red-banned https://safebrowsing.google.com/safebrowsing/report_phish/

[mulka]

Done :-)

[tfarias]

I got it too from yccombinator/-notification. They keep trying with different account/repo names.

[yb0000]

I almost thought it was real, since I’ve never received an actual email from YC. Can anyone share how to apply to YC and what the notification process looks like if you’re selected?

[wonger_]

How will this kind of attack be prevented in the future?

[domdfcoding]

Still at it with a different repo and app that hasn't (yet) been nuked, but I have reported to GitHub.

[domdfcoding]

The repo, the app, and the user account behind each have now all been nuked by GitHub.

[rossant]

Also got it. Redirects to https://y-comblnator.com/apply which is still live. CAREFUL this is a scam.

[mulka]

Stil active repo with issues: https://github.com/ycommbbinator/-co/issues

[om8]

Also got it, found this thread by googling "ycombiinator"

[aanet]

I also received the notification / phishing attack.

Have reported it to Github

[Bender]

Be sure to email this to Daniel dang [email protected] and flag the email as high priority. Be sure to include all the email headers.

Also report it to github [1] and the Feds [2] in the off chance someone takes it seriously. Be sure to include all the email headers here too.

[1] - https://docs.github.com/en/communities/maintaining-your-safe...

[2] - https://www.ic3.gov/

[tomhow]

Thanks, but it's a YC security issue not an HN/dang issue – [email protected]!

[Tremeschin]

Thanks! Just wrote them a warning and forwared the original message.

[mavdotj]

Just got one a minute ago from ycombinator-notify/ycombinator and a bot named mail-notifaction-automatic

[its-all-waves]

Add "ycombinatoor" to the list

[muhuk]

Also `ycombbinator/-co`

[DaxSudo]

Yea I just saw this notif on my GH app.

[Tremeschin]

And another round of mass user tagging at a 'gitcoin-org' username, same message vibe, stopped at 500 issues. This is now a GitHub's duty I assume. Potentially more, I see a couple different names on r/github. Yup, via https://github.com/orgs/community/discussions/174283

[shakibamoshiri]

Got it this morning both mail INBOX and Github notif

[sdpy]

I've received it from ycoommbinator/-co