The Trojan horse of cybercrime: Weaponizing SaaS notification pipelines
Summary: Cisco Talos reports a rise in attackers abusing the automated notification systems of legitimate SaaS platforms, including GitHub and Atlassian, to deliver phishing that passes SPF, DKIM and DMARC because it is sent from the providers' own verified infrastructure. Over a five-day observation period, 1.20% of traffic from noreply@github.com carried an "invoice" lure in the subject line, peaking at roughly 2.89% of the daily sample on Feb. 17, 2026.
What you should know: Your email gateway is effectively blind here: the GitHub messages arrived from a verified GitHub SMTP server with a valid d=github.com DKIM signature, so authentication confirms the platform sent them and says nothing about who triggered the commit or why.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026