How it unfolded

1. 1

   A fake "Security Alert" issue is filed

   The campaign opened issues on roughly 12,000 repositories, styled to look like an automated GitHub security notification about the repository itself.

2. 2

   The link leads to a genuine GitHub authorization screen

   The issue's call-to-action pointed to GitHub's own, real OAuth authorization page for a malicious OAuth App — not a spoofed login page — so it passed SPF/DKIM checks and looked legitimate under every check a developer could reasonably make.

3. 3

   One click grants a persistent token

   Approving the prompt handed the attacker's app a persistent OAuth token. Because the developer's own already-authenticated session did the authorizing, MFA was never re-challenged and never came into play.

4. 4

   The token grants full account and code control

   With that token, the attacker held exactly the access the developer had just authorized: full control over the developer's repositories and account activity, with no password ever touched.

5. 5

   Device-code phishing achieves the same outcome without an app

   A related technique skips installing an OAuth App entirely: research reports success rates above 90% against users in authorized testing engagements using device-code phishing alone.