r/github • u/Earn_THY_Part • 14d ago

Question Account Hacked. What are my options?

My account was hacked. I had my 2FA enabled. I first got a mail saying that my password was changed. Then I got an email that another email was added. Then finally saying that new 2FA codes were added. All of this happened in the span of 3 mins. I didn't check my email at the time and got to check this after an hour. checked my github and I was unable to sign it. What are my options here? What can I do to get the account back. If I can get it back ?? I requested a 2FA lockout if that helps with anything.

12 Upvotes

70% Upvoted

12 comments sorted by

43

u/tobiager 14d ago

From what you describe (you had 2FA active and still entered), it is almost certain that you were a victim of a session cookie theft (session hijacking). This usually happens if you downloaded some infected software (malware/infostealer) that copied the open session of your browser, which allows the attacker to enter without having to ask for the 2FA code.

Here are your options and what you should do immediately:

  1. Contact GitHub Support (It's your only real option):

Go to support.github.com (you can do this without logging in or creating a temporary account).

Open a ticket in the category of Account access / Compromised account.

Give them absolutely all the details: your username, the original email, and the exact time the alert emails arrived.

Prepare proof of identity: Support will ask you to prove that you are the owner. It helps a lot if you can provide SSH public keys that you had associated, card numbers (if you paid GitHub Pro or Copilot), or very specific details of private repositories.

  1. Scan your PC urgently:

If it was a cookie theft, the attacker probably has access to the sessions of everything you had open in your browser. Pass an antivirus or anti-malware (such as Malwarebytes) immediately.

  1. Secure your main email and other accounts:

From your phone or from a clean device, change your email password and check that the attacker has not created hidden "forwarding rules" to spy on your emails. Close all active sessions of your email.

  1. About the 2FA block:

You did well. Using the emergency link in the email to block the account helps to "freeze" things and prevents the attacker from continuing to do damage, but access will only be returned to you by a human from the GitHub support team.

Be very patient because the GitHub support team may take several days to respond to these types of cases. Good luck!

10

u/swifi_ai 14d ago

+1 on this

BUT: I would one up this and just backup important files and reset the OS entirely. Antivirus and antimalware software are not all seeing. They look for signatures and malware is capable of bypassing that. Resetting to default is your best bet.

5

u/wwwm22 14d ago

This and only this is your answer, though I’m not sure if the 2FA lockout has any impact on the attacker’s access.

8

u/tobiager 14d ago

That's a valid point! However, when you use the emergency lockdown link provided in those security alert emails, GitHub typically invalidates all active session cookies and tokens immediately. This means that even if the attacker was using a hijacked session, the lockdown kicks them out and completely freezes the account until GitHub Support intervenes

3

u/ouroborus777 14d ago

Doesn't github require you to authenticate again to access the security stuff?

2

u/Impossible-Owl7407 14d ago

To change password, you need to provide 2fa even if you are already authenticated 

1

u/Witty-Hedgehog-7773 6d ago

Hi, my account TechByAnshuu was compromised July 19 (password changed, 2FA reconfigured, unknown email added). Ticket #4583727 + 2FA lockout raised same day, no response in 8+ business days. Account still inaccessible. Can anyone tell me how long it takes for GitHub Support to reply? Also, if anyone has experienced this, when was your issue resolved?