The Trusted Trap: How Hackers are Weaponizing GitHub and Jira Notifications to Bypass Filters

A routine missive from a familiar service has long since ceased to be a hallmark of security. Specialists from Cisco Talos have identified a nascent surge in cyber offensives wherein adversaries exploit the legitimate notification frameworks of GitHub and Jira to disseminate phishing attempts and spam with minimal interference. From an external perspective, these communications manifest as standard alerts from reputable platforms, thereby engendering less suspicion and attaining a higher rate of successful delivery to their intended recipients.

According to Talos, perpetrators embed deceptive lures directly into the content of automated notifications. Within the GitHub ecosystem, this stratagem revolves around code commits. Attackers forge repositories and infuse the commit descriptions with fraudulent invoices, counterfeit “technical support” prompts, or other data-exfiltration ruses. Once a commit is dispatched, GitHub’s own infrastructure broadcasts the notification. Such correspondence effortlessly satisfies standard authentication protocols—including SPF, DKIM, and DMARC—rendering email filters far less likely to categorize the message as a threat.

Talos reports that during a five-day observation window, 1.2% of all traffic originating from noreply@github.com contained the keyword “invoice” within the subject line. This activity peaked on February 17, 2026, when the proportion of such deceptive emails escalated to approximately 2.89% of the daily sample.

With Jira, the methodology diverges. While the platform itself does not permit the alteration of email templates, it allows for the population of project and invitation fields. Adversaries establish projects within Jira Service Management, inserting misleading titles and introductory prose before broadcasting invitations to targeted addresses. Consequently, Atlassian dispatches a branded email where the malicious lure is seamlessly integrated into a trusted template. This technique is particularly hazardous within corporate environments, where Jira notifications are habitually perceived as internal, utilitarian communications.

Cisco Talos contends that the primary issue lies not in a vulnerability of the platforms themselves, but in the inherent trust afforded to their infrastructure. Criminals utilize the esteemed reputation of SaaS providers as a shroud, circumventing defenses calibrated to verify domain authority and technical authenticity. The authors of the report advocate that organizations scrutinize not merely the sender, but the functional context within the service. This involves analyzing GitHub and Atlassian logs via API, monitoring for anomalous invitations or the creation of dubious projects, and subjecting notifications with atypical content to rigorous secondary verification.