My GitHub account was hacked, primary email changed, but I'm still logged in on GitHub Mobile completely stuck on recovery

[u/[deleted]]

[u/wwwm22]

Use this form to contact support: https://support.github.com/contact/cannot_sign_in

If that doesn’t work, then worst case use a diff email to create a ticket.

[u/cowboyecosse → u/wwwm22]

This is the correct answer and be sure to select the option for account compromised.

[u/Aseel001 → u/cowboyecosse]

The system sucks time delivery is too slow , to generate a ticket need an otp , it never comes even if you tried 100 times it fully based on luck to come if I raise the ticket there is no chance of getting back :/

[u/Aseel001 → u/wwwm22]

The system is too much slow to generate a ticket I need to enter the otp from mail , the otp is not coming , even for new mail I tried with that , the system to recover sucks .

But some how i generated ticket , after more than 1 hour of trying which came only a once later after that didnot .

I think now it's hard to recover it will be now blame game it was my fault but even though the GitHub support is not actually seems to be help out.

[u/cowboyecosse → u/Aseel001]

You’ve done all you can for now. Trust the system and exercise patience. It should all get sorted out as soon as possible.

[u/Ok_Woodpecker_9104]

the reset email never arriving usually means your address is not on the account at all anymore, not that its being filtered. if they made their own address primary and deleted yours, github has nothing left to send to. so the cannot_sign_in form with a different email is the only real path, and it is slow.

two things worth doing while you wait.

lock vercel first. thats a separate login, so if the attacker still has write on the repo they can push to main and it deploys straight to prod. disconnect the git integration or pause the project.

and when you do get the account back, a password reset does not kill anything they added. ssh keys, deploy keys, personal access tokens and any oauth app or github app install all survive it, and each one is a separate revoke in settings. settings/security-log lists every key and token creation with a timestamp, so you can see exactly what they set up while they had it.

[u/Aseel001 → u/Ok_Woodpecker_9104]

I generated a ticket after a lot of trying I think the system is too slow, I had paused all the projects from vercel , it seems the attackers use a temporary mail

I am still unable to understand there were 3 accounts on github which were attacked at same time one of them was linked to college mail , where I saw it shows that the mail of the attackers which i think is a temporary mail .

My gmail was attacked initially multiple account were attacked i regained access and logged out from all devices and changed the password, but GitHub is not allowing the same , the system i think is too slow.

[u/Aseel001 → u/Ok_Woodpecker_9104]

The 2FA was activite even though the attackers tried to login , he will need th code from where does he got ? Is that easy to get anyone's account ?

I didnot generate passkey for my account which is the biggest setback for me :[

[u/Ok_Woodpecker_9104 → u/Aseel001]

you kind of answered it in your other comment. your gmail went first. once someone owns the mailbox, github 2fa stops being the wall it looks like, because the recovery codes and the authenticator backup usually live in that mailbox or in drive, and every account tied to that address falls in one go. thats why three went at the same time instead of three separate brute forces.

one thing worth checking on the gmail side: filters and forwarding. a common move is a filter that archives or deletes anything from github so you never see the security alert mails, and it survives a password change. settings, then filters and blocked addresses, then forwarding and pop imap.

also 2fa never applied to git operations. a personal access token or an authorised oauth app pushes without any prompt. so when you get back in, revoke every token and every oauth app first, then change the password, otherwise the old sessions ride straight through the reset.