In June 2024, security researcher Germán Fernández of CronUp spotted an extortion campaign against GitHub users by an attacker using the Telegram handle "Gitloker." Victims found their repositories wiped and renamed, with a single README file saying their data had been "compromised" and backed up, and telling them to make contact on Telegram. BleepingComputer reported two routes into victims' accounts. The first was stolen credentials. The second was OAuth consent phishing: since at least February, developers had been tagged in spam comments so that GitHub itself emailed them fake security alerts or job offers from [email protected]. The links led to sites such as githubcareers[.]online, where victims were asked to authorise a new OAuth app requesting access to private repositories, personal data and the ability to delete any repository they administered. GitHub said this was a phishing campaign, not a compromise of GitHub or its systems.
Key takeaways
- The Gitloker campaign wiped and renamed GitHub repositories and left a README demanding contact on Telegram.
- Attackers used stolen credentials and, since at least February 2024, phishing that led victims to authorise malicious OAuth apps.
- The OAuth apps requested access to private repositories and the ability to delete any repository the user administered.
- The phishing emails came from GitHub's own notification address because attackers tagged victims in spam comments.
- The identity lesson: an OAuth grant is a standing credential, and consent to a malicious app hands over the same access as a stolen password.
At a glance
| Organisations | GitHub users and organisations targeted by the campaign |
|---|---|
| When | Phishing since at least February 2024; repository wiping reported 5 to 10 June 2024 |
| Attacker | An actor using the Telegram handle Gitloker; unattributed |
| Entry point | OAuth consent phishing via GitHub notifications, and stolen credentials |
| Identities abused | OAuth tokens granted to malicious apps; developers' GitHub accounts |
| Impact | Repositories wiped and renamed; extortion demands; some victims' accounts disabled |
| Category | NHI. Incident class: confirmed NHI breach (malicious OAuth app grants used to wipe repositories) |
What happened
BleepingComputer first reported the attacks on 6 June 2024: "Attackers are targeting GitHub repositories, wiping their contents, and asking the victims to reach out on Telegram for more information." The attacker, who was "posing as a cyber incident analyst," claimed to have taken a backup of the victims' data before deleting it. The ransom note read: "I hope this message finds you well. This is an urgent notice to inform you that your data has been compromised, and we have secured a backup." BleepingComputer said the attacker was "likely compromising targets' GitHub accounts using stolen credentials."
Four days later it reported a second method. "Since at least February, dozens of developers targeted in this campaign have received similar fake job offers or security alert emails from '[email protected]' after being tagged in spam comments added to random repo issues or pull requests using compromised GitHub accounts." The landing pages asked users "to sign into their GitHub accounts to authorize a new OAuth app that requests access to private repositories, personal user data, and the ability to delete any adminable repository, among other things." Some victims also had their accounts disabled, likely after being reported for spam their hijacked accounts had posted.
A GitHub community manager said: "This is a phishing campaign and is not the result of a compromise of GitHub or its systems." GitHub staff advised users: "Never authorize unknown OAuth apps" and "Periodically review your authorized OAuth apps." OX Security noted that the attackers appeared to target users without two-factor authentication. Arnica observed that developers often have local clones, so wiped code could frequently be restored by pushing it again.
Timeline
| Date | Event |
|---|---|
| February 2024 | Phishing via GitHub notifications and malicious OAuth apps begins, according to BleepingComputer. |
| 5 June 2024 | Germán Fernández spots the Gitloker repository-wiping campaign. |
| 6 June 2024 | BleepingComputer reports the attacks. |
| 10 June 2024 | BleepingComputer reports the malicious OAuth app method. |
How it happened: the identity attack path
- Spam tagging. Compromised accounts tagged developers in comments, triggering GitHub notification emails.
- Phishing lure. The emails posed as GitHub security alerts or job offers and linked to fake sites.
- OAuth consent. Victims authorised a malicious OAuth app with access to private repositories and repository deletion.
- Repositories wiped. The attacker deleted contents, renamed repositories and left a ransom README.
- Extortion. Victims were told to contact the attacker on Telegram to recover their data.
Impact
- Repositories: contents wiped and repositories renamed for dozens of targeted developers.
- Extortion: demands to negotiate the return of claimed backups.
- Accounts: some victims' accounts disabled after being used for spam.
What this means for NHI governance
OAuth consent phishing turns a person's click into a non-human credential. The token issued to the malicious app does not need the victim's password or MFA and keeps working until the grant is revoked. In the Gitloker case the scopes requested, including deleting any repository the user administered, should have been a warning, but consent screens are easy to accept when the email came from GitHub's own address.
Organisations should restrict which OAuth apps can access their repositories, review existing grants regularly and teach developers to read scopes. See our SaaS and OAuth App Governance Guide and OAuth 2.0 and OpenID Connect Guide.
Recommendations
- Restrict OAuth app access to organisations. Require approval before third-party apps can reach organisation repositories. See our SaaS and OAuth App Governance Guide.
- Review and revoke authorised apps. Remove grants that are unused or unknown. See the OAuth 2.0 and OpenID Connect Guide.
- Require phishing-resistant authentication. Passkeys or security keys stop credential theft, though not consent phishing. See the Passwordless and Passkeys Guide.
- Back up repositories independently. Keep copies outside GitHub so a wipe is recoverable.
- Alert on destructive actions. Watch audit logs for bulk deletions and renames. See the ITDR Guide.
Frequently asked questions
What was the Gitloker campaign?
An extortion campaign in 2024 that wiped GitHub repositories and left a note telling victims to contact the attacker, known as Gitloker, on Telegram.
How did the attackers get access to repositories?
Through stolen credentials and by tricking developers into authorising malicious OAuth apps that could access and delete their repositories.
Was GitHub hacked?
No. GitHub said it was a phishing campaign and not a compromise of GitHub or its systems.
Related NHI Mgmt Group resources
CoPhish 2025 · GitHub OAuth Token Breach 2022 · SaaS and OAuth App Governance Guide · OAuth 2.0 and OpenID Connect Guide · Passwordless and Passkeys Guide
How NHI Mgmt Group can help
Every OAuth grant is a credential someone has to govern. We help teams control which apps can reach their code, review grants and respond to consent phishing. See our NHI and AI agent security training.
References
- BleepingComputer: New Gitloker attacks wipe GitHub repos in extortion scheme (6 June 2024)
- BleepingComputer: Gitloker attacks abuse GitHub notifications to push malicious OAuth apps (10 June 2024)
- OX Security: Proactive Application Security: Learning from the Recent GitHub Extortion Campaigns (12 June 2024)
- Arnica: 5 Critical Lessons from the GitHub Gitloker Phishing Attack (17 June 2024)