CircleCI, GitHub Users Targeted in Phishing Campaign
Emails purporting to be an update to terms of service for GitHub and CircleCI instead attempt to harvest user credentials.
![Image of mobile phone screen that reads SCAM to illustrate a spear-phishing email campaign Image of mobile phone screen that reads SCAM to illustrate a spear-phishing email campaign](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blte82887710d99d3ed/64f154473fae844d3451fa21/scam_email_Valdislav_Zaretskiy_Alamy.jpg?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
CircleCI has sent out a notice to its customers that a phishing email scam is targeting their users, along with GitHub's, in an attempt to harvest credentials.
The CircleCI security alert included a copy of the malicious email that told recipients that the companies were working together to launch a new terms of service on CircleCI and GitHub accounts.
"As a result of this update, all users will need to review and accept the new Terms of Use and privacy policy in order to continue using CircleCI services," the bogus email read.
Below the notice was a malicious link directing users to log into their GitHub account through CircleCI to accept the new terms.
CircleCI assured its users the company would not require customers to log in to review their terms of service, and pointed out that the malicious link sends victims to circle-ci[.]com, a domain not owned by the company.
"We have no reason to believe your organization has been specifically targeted or that your account has been compromised, but want our customers to be aware that there is an ongoing phishing attempt and to exercise due caution," CircleCI explained in the notice of the active phishing attack to its customers.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024