GitHub OAuth Phishing Campaign
GitHub OAuth Phishing Campaign: K-9 Mail Token Theft Analysis
How threat actors weaponize legitimate OAuth applications to steal persistent Gmail access via GitHub issue spam — a case study in "Legitimate App, Malicious Context" attacks.
A targeted OAuth phishing link was delivered via a GitHub issue on the legitimate
openwrt-es/cfe-bcm63xx repository. The link abuses the real K-9 Mail Android email client
OAuth client ID to request full Gmail access. Victims who complete the flow grant persistent IMAP/SMTP
access to their inbox — no password required, and the token persists even after password changes.
01 Executive Summary
On March 30, 2026, GitHub user carmenperez6804-cyber created issue #8 on the
openwrt-es/cfe-bcm63xx repository — a legitimate OpenWrt router firmware project.
The issue contained nothing but a single hyperlink: a Google OAuth 2.0 authorization URL.
At first glance, the URL appears benign. It points to accounts.google.com, uses
proper PKCE (S256) parameters, includes CSRF protection via state and nonce
tokens, and references a well-known application: K-9 Mail, the popular open-source
Android email client.
This is precisely why the attack is effective. The OAuth consent screen victims see is Google's official UI, displaying a legitimate app's name. There is no fake login page, no typosquatted domain, no grammatical errors. The attacker didn't create a malicious application — they weaponized a real one.
The attacker doesn't need your password. They don't need to bypass 2FA. They simply need you to click "Allow" on a consent screen that looks completely authentic. Once granted, the OAuth token provides persistent, full IMAP access to your Gmail — readable, sendable, deletable — and survives password resets.
02 Attack Timeline
carmenperez6804-cyber created and aged for credibilityopenwrt-es/cfe-bcm63xx containing the OAuth phishing link03 Threat Actor Profile
| Attribute | Value | Assessment |
|---|---|---|
| GitHub Account | carmenperez6804-cyber |
Throwaway naming: [name][numbers][cyber] |
| User ID | 270039645 |
Unique identifier for cross-platform tracking |
| Account Age | ~6 months | Purpose-built; not a compromised legitimate account |
| Tactics | Repository issue spam | Targets high-visibility open-source projects for maximum reach |
| Technical Skill | Medium | Proper OAuth implementation (PKCE, state, nonce) — not crude |
| Target Audience | Technical users | OpenWrt developers likely have infrastructure/admin Gmail accounts |
The account exhibits classic disposable persona indicators: a hyphenated "cyber" suffix, numeric padding, and zero repository activity. This is not a compromised developer account — it's a purpose-built phishing node designed to blend into GitHub's ecosystem just long enough to deliver payloads.
04 Technical Analysis
4.1 The OAuth URL (Fully Decoded)
4.2 Parameter Security Analysis
| Parameter | Value | Security Assessment |
|---|---|---|
client_id |
262622259280-... |
Legitimate — Confirmed K-9 Mail client ID. This is NOT a fake app. |
redirect_uri |
com.fsck.k9://oauth2redirect |
Attacker-controlled — Deep-links to attacker's K-9 Mail instance on Android. |
login_hint |
alexiscosme3@gmail.com |
Pre-filled target — Suggests harvested credential or specific targeting. |
state |
Wl2kUJop6uVy2ZqH0f_bpw |
Properly random — ~128 bits entropy, base64url encoded. CSRF protection. |
nonce |
h4dQ6lRauQVFTOq1qS_atQ |
Properly random — ~128 bits entropy. OIDC replay protection. |
scope |
https://mail.google.com/ |
FULL ACCESS — Read, compose, send, delete ALL emails and labels. |
code_challenge |
OLrlHx9rd5bgJwYPl0Nnw0EwW8c79yWQkxNqUGQgRis |
PKCE-S256 — Properly implemented. Prevents MITM code interception. |
The attacker implemented OAuth correctly from a security engineering standpoint. PKCE, state tokens, and nonce are all properly configured. This isn't a sloppy attack — it's a deliberately polished one. The technical correctness is what makes it convincing.
4.3 Why This Consent Screen Is Dangerous
When a victim clicks this link, they see Google's official OAuth consent screen:
K-9 Mail wants to access your Google Account
This will allow K-9 Mail to:
- Read, compose, send, and permanently delete all your email from Gmail
- See, edit, create, and delete all your Google Drive files
- View your email messages and settings
Victims trust this because: (1) K-9 Mail is a real, well-known app, (2) the URL is on
accounts.google.com, (3) the UI is Google's official design, and (4) the security
parameters (PKCE, state) make it look "legitimately secure."
05 Attack Vectors
5.1 Primary: Repository Issue Spam
The attacker creates issues on popular open-source repositories with high star
counts. The openwrt-es/cfe-bcm63xx project targets technical users — developers and
network administrators who likely manage infrastructure credentials via Gmail.
5.2 Secondary Vectors
GitHub sends email alerts for new issues. Victims may click from their inbox without examining the URL closely.
The com.fsck.k9:// scheme strongly suggests the attacker expects Android users with K-9 Mail installed.
The login_hint may originate from a prior breach list, streamlining the attack for known targets.
5.3 Post-Compromise Pivot
Once Gmail access is granted, the attacker can:
- Search for crypto wallet recovery phrases and seed backups in email archives
- Reset passwords on banking, social media, and corporate services using "forgot password" flows
- Impersonate the victim in email conversations with colleagues, vendors, or family
- Register for new services using the victim's identity for fraud or further compromise
- Sell IMAP access on dark web markets as "Gmail logs with full inbox access"
06 Indicators of Compromise
Network IOCs
Account IOCs
Behavioral IOCs
- Unexpected "K-9 Mail" entry in Google Account → Security → Third-party apps
- IMAP connections from unknown IP addresses in Gmail access logs
- Outgoing emails in Sent folder that the user didn't send
- OAuth token grants for K-9 Mail from unexpected device/location
07 Defensive Recommendations
For Individual Users
- Never click OAuth links sent via unsolicited messages — even on trusted platforms like GitHub
- Verify the
login_hint— if it shows someone else's email, it's targeting that account - Audit Google permissions:
myaccount.google.com/permissions— revoke suspicious K-9 Mail access - Enable Google Advanced Protection if you're a high-risk target (journalist, activist, admin)
- Review Gmail access logs regularly for unknown IMAP connections
For GitHub Maintainers
- Report the account at
github.com/contact/report-abuse - Lock issue conversations on spam issues to prevent further exposure
- Enable issue templates requiring structured input — reduces drive-by spam
- Use GitHub's "Mark as spam" feature — trains their ML detection models
- Consider requiring approval for first-time contributors' issues
For Security Teams
- Hunt for the K-9 Mail client ID in proxy logs for unexpected internal OAuth grants
- Monitor email gateways for
accounts.google.comURLs withcom.fsck.k9redirect URIs - Check Google Workspace audit logs for OAuth token grants to K-9 Mail from corporate accounts
- Block the GitHub account in corporate SSO if employees use GitHub Enterprise
08 Detection Queries
Sigma Rule (Proxy/SIEM)
title: K-9 Mail OAuth Phishing Detection
logsource:
category: proxy
detection:
selection:
- c-uri|contains: 'accounts.google.com/o/oauth2/v2/auth'
- c-uri|contains: 'com.fsck.k9'
- c-uri|contains: 'mail.google.com'
condition: selection
falsepositives:
- Legitimate K-9 Mail OAuth setup on Android
level: medium
tags:
- attack.credential_access
- attack.t1606Google Workspace BigQuery (GCP Audit Logs)
SELECT
timestamp,
protoPayload.authenticationInfo.principalEmail,
protoPayload.serviceData.oauth2Approval.clientId,
protoPayload.serviceData.oauth2Approval.scopes
FROM `project-id.audit_logs.cloudaudit_googleapis_com_data_access`
WHERE
protoPayload.serviceData.oauth2Approval.clientId =
'262622259280-hhmh92rhklkg2k1tjil69epo0o9a12jm.apps.googleusercontent.com'
AND TIMESTAMP_TRUNC(timestamp, DAY) >= TIMESTAMP("2026-03-30")
ORDER BY timestamp DESC;09 Lessons Learned
The attacker didn't create a fake app — they abused a real one's OAuth client ID. This bypasses user skepticism entirely.
Users expect GitHub to be safe. Issue spam on legitimate repos exploits this trust at scale.
PKCE protects against auth code interception (MITM), not social engineering. The attacker IS the legitimate recipient.
A stolen Gmail OAuth token persists after password changes and bypasses 2FA for IMAP access. More dangerous than credentials.
It reveals the attacker's reconnaissance — likely harvested from a previous breach or public data source.
Proper state, nonce, and PKCE implementation make the attack look legitimate. Sloppiness would raise flags.
10 Appendix
Full Decoded URL Parameters
| Parameter | Decoded Value | Entropy / Notes |
|---|---|---|
state |
Wl2kUJop6uVy2ZqH0f_bpw |
~128 bits — cryptographically sound |
nonce |
h4dQ6lRauQVFTOq1qS_atQ |
~128 bits — proper OIDC replay protection |
code_challenge |
OLrlHx9rd5bgJwYPl0Nnw0EwW8c79yWQkxNqUGQgRis |
~256 bits — S256 PKCE verifier hash |
References
- RFC 6749 — OAuth 2.0 Authorization Framework
- RFC 7636 — Proof Key for Code Exchange (PKCE)
- Google OAuth 2.0 for Mobile & Desktop Apps
- MITRE ATT&CK T1566.002 — Spearphishing Link
- K-9 Mail (Thunderbird Android) GitHub Repository
Classification: UNCLASSIFIED — Share for defensive purposes
Generated by: frankSx, unmake labs
Last Updated: 2026-04-10
Status: IOCs extracted and documented. GitHub account reported for abuse.
Comments
Post a Comment