Mass Phishing Emails Pretending to Be Y Combinator Right Now
Key topics
- (3m in) They seem to have been rate limited or reached a target of 500 issues
- (5m in) Repository was just taken down, hope they automate back a warning
- They have typo-squatted the "y-comb[l]nator [dot] com" domain (with hyphen and L)
Quite urgent actions are needed to stop it, or warn the affected. Will update the submission with more information as time goes.
- [1]: https://github.com/ycombinato/
A mass phishing campaign is targeting users by pretending to be Y Combinator, using GitHub to spread malicious emails and notifications, prompting a swift response from the community and GitHub.
Snapshot generated from the HN discussion
Discussion Activity
Active discussionFirst comment
2m
Peak period
14
0-3h
Avg / period
4.4
Based on 31 loaded comments
Key moments
- 01Story posted
Sep 23, 2025 at 4:52 PM EDT
3 months ago
Step 01 - 02First comment
Sep 23, 2025 at 4:55 PM EDT
2m after posting
Step 02 - 03Peak activity
14 comments in 0-3h
Hottest window of the conversation
Step 03 - 04Latest activity
Sep 25, 2025 at 3:57 AM EDT
3 months ago
Step 04
Generating AI Summary...
Analyzing up to 500 comments to identify key contributors and discussion patterns
Want the full context?
Jump to the original sources
Read the primary article or dive into the live Hacker News thread when you're ready.
either its something i have changed on this particular agent, somthing changed on HN, or a newly aquired feat due to accumulated X.P.
thanx for pointing at it.
Also report it to github [1] and the Feds [2] in the off chance someone takes it seriously. Be sure to include all the email headers here too.
[1] - https://docs.github.com/en/communities/maintaining-your-safe...
[2] - https://www.ic3.gov/
These spam repositories have been deleted, but I still had lingering notifications stuck on GitHub, and I couldn't see them in the UI to remove them (but the small blue notification dot was constantly on). The API hack resolved this problem.
The best email address for anything like this is security@ycombinator.com, as they handle security issues for all of YC, including applications.
Thanks everyone for letting us know about this.
Have reported it to Github
Also, on the report abuse page that I got to from the user profile page, the green submit button is nearly hidden by the grey footer, even when I scroll the page around and complete the captcha.