Scam/Phishing Alert: Fake GitHub Notification Email Impersonating Gitcoin Fund

[kelvinelove]

Discussion Type

General

Discussion Content

🚨 Possible Scam Alert: Fake GitHub Notification Email

Hey GitHub Community,

I wanted to flag a potential phishing attempt that’s circulating and appears to come from the GitHub notifications email. The message references a "$15M GitHub × Gitcoin Developer Fund 2025" and is formatted to look like a legitimate issue notification from a bot named git-notifler[bot].

⚠️ Key Red Flags:

• The sender mimics GitHub’s notification format but uses a misspelled bot name (git-notifler instead of git-notifier).
• It claims my GitHub account qualifies for a $15M fund and prompts me to verify my wallet using Gitcoin Passport.
• The link provided (grants.github.com/apply) looks convincing but requires a deposit to proceed—framed as “refundable.” Also, (I checked it in a sandbox, don't worry) the link redirects to some random site that brings a popup to link your crypto wallet when you click anywhere on the site... Major Red Flag
• The language is polished but includes subtle urgency and vague eligibility criteria.

Why This Matters:

This kind of scam targets developers who trust GitHub’s notification system. It exploits the familiar layout of issue creation emails and leverages Gitcoin’s name to appear credible. If someone unknowingly connects their wallet and signs a message, they could be exposing themselves to financial risk.

What (I suggest) You Can Do:

• Do not click on suspicious links or connect wallets unless you're 100% sure of the source.
• Report similar emails to GitHub and Gitcoin.
• Spread awareness - especially to newer contributors who might not recognize the signs.

If anyone else received this or has insights into how it's being distributed, feel free to share below. Let’s keep our community safe and informed.

PS: I am not in any authority or position to tell you what to, and what not to do. But I did think raising awareness about this is necessary.

Just wanted to give you all a heads up. I don't know how widespread this is but hey, if it reaches someone like me on some random corner of the planet, chances are it's targetting a lotta unsuspecting devs.

[billythekid]

Thanks for this. It's a known scam phishing campaign and our teams are working on taking it all down.

Please do not click on any links in any notifications you may receive.

If anyone else received this or has insights into how it's being distributed, feel free to share below. Let’s keep our community safe and informed.

Please don't do this.

[billythekid]

Hey @billythekid, could you guys please look into the ghost notifications from these removed scam repos. Thank you.

Howdy again!

Yep for sure. We're looking into the notifications thing not being dismissible. Hopefully we'll make these go away automatically soon. The emails are annoying enough (ugh I hate spammers) but this is just the cherry on top and I think even more annoying as we all know to just ignore the scam, but this draws your eye. Super frustrating we know, and we are aware and working on it I assure you.

[irfan-sec]

thanks man

[VisionR1]

I got this 1 hour ago, via email, but and as notification from GitHub app.

[bgroenks96]

@felipealfonsog This was driving me crazy, thank you so much!

[StevenMasini]

@felipealfonsog Thanks! I ❤️ U

[shulaoda]

Got rid of it with:

gh auth login    
gh api -X PUT /notifications

Superman! ❤️

[MH15]

Thank you @felipealfonsog!!!

[partybrasil]

Got rid of it with:

gh auth login    
gh api -X PUT /notifications

Aqui me ha funcionado!! Thxxx

[tuliosousapro]

I also received that shit!
What really got on my nerves is that the sender is actually notifications@github.com

So we all need to be extra careful!!!

[irfan-sec]

man it is possible to spoof smtp i am my career i am learning daily these kind of stuff.

[billythekid]

It's not spoofing. "GitHub" is sending these (or more correctly the scammer is using GitHub's notification system to send these.) That’s what makes it look more legit. It's not GitHub though, it's the scammer. All these are are issue at-mentions. They're just made to look good (mad scammy, but "good")

GitHub is not pairing with any crypto stuff to my knowledge. I don't foresee that changing any time soon.

[I21b]

They create issues under gitcoi/norg (or similar) with bunch of mentions, so GitHub sends an email based on your preference, you can see the mentions at the bottom of that email.

[VidiotGeek]

Yep. Just discovered a similar phishing email myself. I recently started using email aliases for everything (Github included) and got a scammy email pretending to be affiliated with Y-Combinator through the legitimate notifications noreply@github.com address--to my new, private, email account. Turned out that I had my real email set as primary instead of my dedicated Github alias.

It's a never-ending cat and mouse game with these people.

[Crane-Mocker]

Here is an analysis on this phishing: https://jimmysong.io/en/blog/github-gitcoin-fund-phishing-2025/
Also the discussion: https://github.com/orgs/community/discussions/174283

[Mordax]

Thanks for this. This email almost caught me out. I received multiple emails and I didn't see any information online until this thread.

[wedesoft]

Also received it earlier "from github.com (hubbernetes-node-3f7204a.ash1-iad.github.net [10.56.208.64]) by smtp.github.com". Edit: ok, read Jimmy Song's report from above. So they actually managed to abuse the GitHub notification system for this.

[PPPDUD]

Can confirm that this is happening to me.

[X012C]

Is there any way to clear that ghostly unread notification?

[Parsifa1]

gh api notifications -X PUT -F last_read_at=2025-09-24T00:00:00Z

using something like this ..

[ppbrown]

I mean... its a scam and all, BUT....

what they are suggesting is a cool idea. Might be nice if github DID actually natively support a bitcoin donation integration thing.

[benjlevesque]

@Parsifa1 thanks for the tip! works like a charm...

[iptton]

gh api notifications -X PUT -F last_read_at=2025-09-24T00:00:00Z

using something like this ..

many thanks!!

[marcelpetrick]

Truly horrible and weird that this is not fixed programmatically. Will apply the fix. Thank you.
But why not add a UI-element, because you will only find this when you investigate that issue (a blue dot for your inbox) actively.

[charithjayasanka]

I've also got the mail and noticed that the link highlighted looks like this

While it goes to

[elsecaller0x]

I got this too.

[I21b]

The email gives a link that looks like https://grants.github.com/apply (not exist),
but actually a fishing link like https://github-***.com/ (unofficial), https://gitcoin-***.com/ (unofficial) or similar scams

edit: not to share potentially unsafe or suspicious URLs in public spaces, to help keep the Community safe for everyone. (tag the user or repo instead?)

[VisionR1]

I get this for second time, one yesterday and one today.

[bhlindemann]

Same, received as well

[I21b]

They create issues under a repo (gitcoi/norg or similar fake official) with bunch of mentions, abusing GitHub's notification system, make GitHub sends an email based on your preference, you can see the mentions at the bottom of that email.
The email gives a link that looks like https://grants.github.com/apply (not exist),
but actually a fishing link like https://github-…….com/ (unofficial), https://gitcoin-…….com/ (unofficial) or similar fake links.

[PPPDUD]

Incorrect; the emails WILL come from an official GitHub domain. Please stop spreading dangerous misinformation.

[RooTinfinite]

A new wave of attacks. They are using a different account and different bug-reporting systems.

Notably, GitHub strongly favors such notifications: the alert shows up on the phone, by email, and on the GitHub website.
This increases credibility, since similar notifications often appear regarding our work and projects.

[I21b]

Things like mentions just notifying with an email,
they are abusing the notification system 😢

[JamesMowery]

Any update on getting rid of these from the sidebar? Appars there were two scams going on.

[VisionR1]

Maybe I'm not clear enough: I have already done that. I've clicked that bookmarklet dozens of times, even after removing all notifications.

They are still on the sidebar. You can clearly see I have zero notifications.

Strange.

With at least one other exist notification ?

[Oyami-Srk]

Could you please click the "gitcointeam/gitcointeam" and check if there is "0-1 of 1" in the left corner, instead of "No results" in the center. If so, you perhaps just use the API way to mark the notification as read, but not as done. I have the same problem as yours, and I used the script posted in https://github.com/orgs/community/discussions/174380#discussioncomment-14719109 when I navigate to the query result (after click the "gitcointeam/gitcointeam") to remove the repo from my sidebar.
Please give it a try; it might just work. I'm not using the bookmark way, but the F12, then paste & enter. FYI.

[JamesMowery]

@Oyami-Srk I did try clicking the bookmarklet while I was on those pages previously and nothing happened. But I just went back to those pages and did the F12 + paste in console method and it worked. Thank you!

[Crypt-iQ]

Thank you!

[SamEdwardes]

I found this solution to remove from sidebar. It worked for me: https://stackoverflow.com/questions/79209575/how-to-clear-unread-notifications-for-a-deleted-repository-on-github

[pixelphil]

Adding another offending repo to the discussion. It would be nice to see it removed from the sidebar. Like others here, I also had the ghost notification issue but one of the solutions mentioned above took care of that.

[aldoram5]

Bumping the thread, I'm facing the same as others:

I was able to remove notifications with the script passed around but the offending repo is still there.

[vrdriver]

/
Yep, and I just got this scam/spam/crap too, from an email of noreply@github-alert.com
Could be related - or just a typical scam/spam email.

[ghost]

I removed the blue dot with api but the repo's been on this list for a solid month... And it seems there's no way to remove it?

[partybrasil]

Não aguento mais estes scammers.. não tem jeito de forçar e destruir os repositorios e contas destes indesejáveis?
Consegui limpar as flags de notificações novas com a solução da api postado aqui mas, seguem aparecendo aqui...
Amigos, avisem se há novidades plz

[Stephlovesone]

Thanks for drawing users attention to this so users don't fall victims

[alexceltare2]

I can't get rid of these nor the notification bubble!

[felipealfonsog]

try :
gh auth login gh api -X PUT /notifications

[KSemenenko]

Nope

[felipealfonsog]

Nope

Many users reported this fix worked for them. See details here: https://github.com/orgs/community/discussions/174380#discussioncomment-14479127

[KSemenenko]

how I have this, and I can't remove them

[skyrpex]

how I have this, and I can't remove them

They stood there for a while for me, too. One or two weeks later, after cleaning all my notifications the usual way, they went away as well.

[happymoodhubpro]

• Don’t click links in emails like these claiming a “$15M GitHub × Gitcoin Developer Fund 2025” that ask for wallet deposits or passport verification.
• Check sender/bot names — for example “git-notifler[bot]” is a red flag vs the real “git-notifier”.
• Never connect your wallet or sign messages unless you’re 100% sure of the source.
• Report these to GitHub and Gitcoin and let newer devs know.
• As a bonus tip: treat apps or stores like HappyModapk like you would suspicious links only use trusted sources and verify authenticity.

[sleepynight2024]

I am keep getting notification from this but when i check i see nothing in notifications

[KSemenenko]

the ame for me

[sokai]

Solution: https://github.com/orgs/community/discussions/174283#discussioncomment-14788489
gl + KR

[SynapseScribe]

it's funny how a post about scam became the spam.. usubscribing xD. ty all for help !!

[p0nce]

Please help me, I still have annoying fake notifications in my GitHub notifications about a repo "ventures-gitcoin/gitcoin.com" which AFAIK doesn't exist. It still show up on my account, I never participated there.

[sureshg]

GitHub is not going to do anything to clear these notifications (I have been waiting for the last several months). Your best bet is to delete them using the API. If you're on Mac,

$ brew install gh
$ gh api notifications | jq '.[] | { id, title: .subject.title, repo: .repository.full_name }'
$ gh api --method DELETE notifications/threads/<Thread ID>

[tenequm]

finally, could get rid of them, they were annoying me for months already
@sureshg tnx a lot for sharing those commands 🙏

[YuenSzeHong]

suggestion: close this thread, as scammers just come here to comment fishing spams

[evanskofiassafuah]

1. Report it on GitHub:
   • Go to your notifications → find the thread → click “Report content” or “Mark as spam/abuse”.
   • If the repo is deleted, report via GitHub support: https://support.github.com/ (mention phishing via notifications).
   • You can also mute/unsubscribe from the thread to stop emails.
2. If you want real Gitcoin funding (legitimate quadratic funding for open-source projects):
   • Visit official site: https://www.gitcoin.co/ or https://grants.gitcoin.co/.
   • Create projects there, apply to rounds (no upfront deposits ever required).
   • Use Gitcoin Passport for identity (but only on official domains; never via unsolicited emails).
3. Protect yourself:
   • Never connect wallets or sign transactions from unsolicited links/emails.
   • Verify announcements only on official channels (github.blog, gitcoin.co/blog, @github / @gitcoin on X).
   • Use tools like uBlock Origin or email filters for crypto spam keywords.

[Fury1]

@kelvinelove Please end the discussion to end the comment spam fishing attempts.

[kelvinelove]

Good call. I've closed it