A new wave of cyberattacks has recently been detected by investigators exploiting existing infrastructure to deliver malicious content. This is not an unknown phenomenon, of course, but the new method showcases a new form of ingenuity on the part of threat actors. Unlike earlier methods of phishing attacks, traditional detection methods will not detect these attacks, because the messages come from completely legitimate sources. This technique, called Platform-as-a-Proxy (PaaP) by investigators, leverages legitimate services such as GitHub and Jira to send emails through trusted channels, increasing the likelihood that these messages bypass security controls and reach users’ inboxes.

This technique relies on abusing built-in notification systems that automatically generate emails based on platform activity. On GitHub, for example, the platform automatically sends notification emails to subscribers when commits are made. By creating or taking control of repositories, attackers can insert malicious content into the commit messages via the User interface Mechanism, inserting scam content into the field intended for extended descriptions. In examples obtained by Cisco Talos, investigators uncovered a large-scale phishing attack delivered via GitHub notification which contained a fake billing statement. The email itself was absolutely legitimate, with a genuine GitHub signature, yet it contained malicious content, bypassing signature-based detection. Similarly, in Jira, attackers can manipulate project configuration fields such as project names or welcome messages. These inputs are then incorporated into system-generated emails, such as service desk invitations, allowing malicious content to be delivered under the guise of trusted organizational communication.

These campaigns are primarily designed to support credential harvesting and initial access operations. By leveraging trusted platforms, attackers increase the credibility of their lures and improve the success rate of social engineering attempts. This approach reflects a broader shift toward using legitimate services as intermediaries, effectively masking malicious intent behind trusted delivery mechanisms. Because of this, traditional trust models based on email authentication can no longer be considered sufficient. Instead, organizations should adopt a zero-trust approach that evaluates the legitimacy of the activity generating the notification. Recommended strategies include restricting notifications to verified SaaS instances, monitoring platform activity via APIs for suspicious behavior, analyzing whether message content aligns with expected platform use, and introducing additional verification steps for high-risk interactions.