FAKE "SECURITY ALERT" ISSUES ON GITHUB USE OAUTH APP TO HIJACK ACCOUNTS

Summary from the TLDR InfoSec newsletter

A phishing campaign on GitHub uses fake "Security Alert" issues to trick users into granting access to a malicious OAuth app, giving attackers complete control over accounts and code. The alerts mention unusual activity from Reykjavik, Iceland, and the 53.253.117.8 IP address, urging users to allow risky permissions. Affected users must revoke access, inspect for suspicious apps, and change credentials immediately.