Arszilla

OSINT Tip: GitHub OPSEC Mistake by Threat Actors When investigating threat actors that use GitHub as a malware distribution platform, check whether the commit was uploaded via the GitHub web interface. If so, the commit author's email may be linked to the GitHub account, meaning you may be able to obtain the threat actor's email address. → GET /repos/<user>/<repo>/commits → commit[.]author[.]email or → Append .patch to the commit URL and inspect the From: header. Bingo. You can then pivot on that email using OSINT platforms or manual research to uncover additional information about the threat actor. Note: This only works if the actor has disabled GitHub's "Keep my email addresses private" setting. If the setting is enabled, the author email will appear as …@.users.noreply.github.com instead of the real email address. However, many TA repositories still have this setting disabled.