GitHub notification emails used to send malware