Threat Actors Weaponize GitHub & Jira Notification Pipelines to Bypass Email Defenses
What Happened — Adversaries are abusing the built‑in notification features of popular SaaS collaboration tools (GitHub, Jira/Atlassian) to send spam and phishing emails from the platforms’ own mail infrastructure. The technique, dubbed “Platform‑as‑Proxy (PaaP),” lets malicious messages pass SPF/DKIM/DMARC checks, dramatically increasing delivery success.
Why It Matters for TPRM —
- Legitimate SaaS providers become inadvertent attack vectors, expanding the attack surface of any third‑party ecosystem.
- Traditional email security controls (reputation filters, DMARC enforcement) are bypassed, raising the risk of credential theft across all downstream customers.
- The abuse is scalable and can affect any organization that integrates with these notification APIs, making vendor risk assessments more complex.
Who Is Affected — Technology‑SaaS vendors, development teams, and any enterprise that consumes GitHub, Jira, or similar collaboration platforms for workflow automation.
Recommended Actions —
- Review contracts and security questionnaires for SaaS notification services; require evidence of abuse‑mitigation controls.
- Enforce strict content‑filtering on inbound emails, even when SPF/DKIM/DMARC pass, using anomaly‑based detection.
- Monitor outbound API calls to GitHub/Jira for unusual commit patterns or bulk notification generation.
- Work with SaaS providers to implement rate‑limiting, abuse‑reporting, and signed payload verification for notification APIs.
Technical Notes — Attackers embed malicious links or lure text in commit summaries or Jira issue descriptions, triggering automated email notifications. Because the emails originate from the SaaS provider’s mail servers, they inherit full authentication headers, rendering conventional gateway checks ineffective. The campaigns observed a 2.89 % injection rate on GitHub‑generated emails on 17 Feb 2026. Primary impact: credential harvesting and subsequent lateral movement. Source: Cisco Talos – Weaponizing SaaS Notification Pipelines