Attackers abuse GitHub and Jira notification systems to deliver phishing emails

Attackers are routing malicious content through the legitimate infrastructure of trusted SaaS platforms, bypassing SPF, DKIM, and DMARC, the three controls that modern email security depends on to distinguish genuine senders from fraudulent ones.

What happened

Researchers have documented active campaigns in which attackers abuse the notification systems of GitHub and Jira to send phishing and spam emails that satisfy all standard email authentication requirements. According to Help Net Security, because the emails are sent from each platform's own infrastructure, they pass SPF, DKIM, and DMARC checks automatically, removing the authentication-based signals that email security gateways rely on to flag suspicious messages. Researchers also noted that by decoupling malicious intent from the sending infrastructure, attackers deliver phishing content with a technical seal of approval that few security gateways are configured to challenge.

Going deeper

On GitHub, attackers exploit the platform's repository notification system by pushing a commit to an existing project and embedding malicious content in the commit's text fields. When a commit is created, GitHub provides a summary field and a longer description field. The summary appears first in notification emails, so attackers use it to display a message designed to grab attention, while the main phishing content, such as fake billing details or credential-harvesting links, is embedded in the longer description. The resulting email is generated entirely by GitHub's own systems and carries no indicators of external manipulation. On one observed peak day, approximately 2.89 percent of emails sent from GitHub were linked to this type of abuse. On Jira, attackers register an account, create a Service Management project with a legitimate-sounding name, insert malicious content into the Welcome Message or Project Description fields, and then use Jira's built-in ‘Invite Customers’ feature to send emails to victim addresses. Atlassian's backend assembles the invitation using its own cryptographically signed template, automatically incorporating the attacker-controlled field values. The result is a professionally formatted Atlassian Service Desk notification with official branding. Because Jira notifications are expected in corporate environments and rarely blocked, these emails encounter little resistance.

What was said

Researchers stated that the emails "are dispatched from the platform's own infrastructure" and "satisfy all standard authentication requirements (SPF, DKIM, and DMARC), effectively neutralizing the primary gatekeepers of modern email security." They added that "by decoupling the malicious intent from the technical infrastructure, attackers successfully deliver phishing content with a 'seal of approval' that few security gateways are configured to challenge." The report was published on April 9, 2026.

In the know

The abuse of legitimate platform notification systems to bypass email authentication is not new, however the attack surface for this technique has grown as enterprise software stacks have expanded. According to BleepingComputer, a widespread phishing campaign in March 2025 targeted 12,000 GitHub repositories with fake security alerts designed to trick developers into authorizing a malicious OAuth app, and in June 2024, attackers similarly triggered GitHub's email system via spam comments and pull requests to direct targets to phishing pages. The pattern extends beyond GitHub. In January 2026, The Hacker News reported on a campaign abusing Google Cloud's Application Integration email feature to send phishing messages from a legitimate Google address, with attackers sending over 9,000 phishing emails to approximately 3,200 customers across multiple industries, including healthcare.

The big picture

Standard email authentication, SPF, DKIM, and DMARC, verify that an email was sent from a server authorized to send on behalf of a given domain. When the sending server is genuinely the platform's own infrastructure, those checks pass regardless of whether the content is malicious. Healthcare organizations that rely on DMARC enforcement as a primary defense face a structural gap with this class of attack. According to Paubox's 2026 Healthcare Email Security Report, 74 percent of healthcare organizations that suffered email-related breaches in 2025 either lacked DMARC entirely or had it set to monitor-only mode. Even where DMARC is fully enforced, it cannot flag a message that arrives from GitHub's or Atlassian's legitimate sending infrastructure. Defense against this technique requires behavioral analysis of email content and context rather than sender authentication alone, along with training staff to treat unexpected notifications from platforms requesting credentials or payment details with the same scrutiny applied to any unsolicited message.

FAQs

What are SPF, DKIM, and DMARC, and why can they not catch this type of attack?

SPF verifies that an email was sent from a server authorized to send on behalf of the listed domain. DKIM adds a cryptographic signature confirming the message has not been tampered with in transit. DMARC ties both checks together and tells receiving servers what to do with messages that fail. When a message genuinely originates from GitHub's or Atlassian's own servers, all three checks pass legitimately, because the attack exploits the platform's real infrastructure rather than spoofing it.

Why are Jira notifications particularly difficult for email security tools to block?

Jira notifications are routine in corporate environments where teams use Atlassian tools for project management and service requests. Email security tools configured to trust known enterprise SaaS senders will allow these messages by default. Blocking Jira notification domains entirely would disrupt legitimate business communications for organizations that rely on the platform.

What specific content are attackers embedding in these legitimate notifications?

In the documented GitHub campaigns, attackers embedded fake billing alerts and phishing links in commit description fields. In the Jira campaigns, malicious content such as fake security alerts was placed in the Welcome Message or Project Description fields, which Atlassian's system then incorporated into its own branded invitation emails.

How can organizations protect against notification abuse attacks?

Organizations should train staff to treat any notification requesting credential entry or payment action as requiring independent verification, regardless of the sending domain. Email security controls that analyze message content and context, rather than relying solely on sender authentication, provide better coverage against this attack class.