GitHub and Jira Alerts Hijacked for Trusted

Gbhackers •Mayura Kathir • April 13, 2026

Hackers are abusing GitHub and Jira’s built‑in notification systems to send phishing emails that appear completely legitimate. Because these emails are sent from the platforms’ own mail servers, they pass standard checks like SPF, DKIM, and DMARC, making them very hard for traditional email gateways to block. The messages are routed via the official mail […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GitHub and Jira Notification Systems Exploited for Phishing Attacks Cybercriminals have exploited GitHub and Atlassian Jira's notification systems to send phishing emails that appear legitimate. These emails bypass standard security checks such as SPF, DKIM, and DMARC because they originate from the platforms' own mail servers. Attackers have specifically targeted GitHub's automated commit notifications, crafting malicious commits that trigger phishing emails related to billing issues. Similarly, Jira's invitation and service desk workflows have been manipulated to inject phishing content into trusted templates, leading to the distribution of seemingly authentic messages. Organizations using these platforms are urged to enhance identity verification measures and adopt a zero-trust approach for SaaS notifications. The ongoing exploitation poses a significant risk to users and organizations relying on these collaboration tools. 2 sources 68

Extracted Entities

GitHub and Jira Alerts Hijacked for Trusted

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (2)