A click-fraud bot led me to 5,552 GitHub accounts tied to public inboxes

A malware researcher investigating a click-fraud bot found it running through 38 repositories on long-dormant GitHub accounts. Comparing recent commits with work from years earlier, the researcher saw that many used the same disposable email addresses, such as Mailinator and Yopmail, whose inboxes are publicly readable. A test on the researcher’s own account showed that a GitHub password-reset message sent to such an address could be used to regain access. Because old commit histories reveal the address, the researcher searched for other accounts with the same exposure. The search identified 5,552 live accounts whose earlier commits used public inboxes; 917 were already running the bot. Across the wider campaign, 965 accounts owned 1,014 repositories, and many new workflows had been added through GitHub’s web editor.

After the researcher reported the risk, 18 previously identified dormant accounts added the bot’s workflow within four days, strengthening the case that the operator was targeting accounts selected by this pattern. The bot’s scripts continued to circulate on Hugging Face despite removals, with one dataset reaching nearly a million downloads in 30 days. GitHub classified the report as informative, calling the behavior a known issue without significant security risk. The researcher found no evidence of broader malicious activity, but stresses that write access to abandoned repositories remains a vulnerability regardless of how it is used. The recommendations are to replace disposable addresses on old accounts, enable two-factor authentication, inspect repositories for unfamiliar workflows, and ensure platforms protect existing accounts as well as blocking disposable addresses at signup.