Fake VS Code Alerts on GitHub: Malware Hidden in Plain Sight

A large-scale phishing campaign is exploiting GitHub Discussions to push malware disguised as urgent Visual Studio Code security advisories. Thousands of posts flood repositories with alarming titles like “Critical Exploit – Urgent Action Needed” and fabricated CVEs, tricking developers into downloading malicious “patched” versions of VS Code.

How the Attack Works

• Fake advisories: Posts mimic official GitHub security alerts.
• Mass tagging: Newly created accounts tag hundreds of developers across unrelated repos.
• Email amplification: GitHub Discussions trigger email notifications, spreading the fake alerts beyond GitHub itself.
• Malicious links: Instead of Microsoft’s official channels, victims are redirected to file-sharing sites hosting malware.

Technical Details

• Multi-step redirection: Links route through Google share endpoints, Cloudflare Workers, and Vercel before landing on attacker infrastructure.
• Fingerprinting stage: Obfuscated JavaScript collects browser data (timezone, locale, user agent, automation signals).
• Payload delivery: Real users are filtered from bots, then served phishing pages or exploit kits.

Why It’s Dangerous

• Trusted environment abuse: Developers are targeted inside GitHub, a platform they rely on daily.
• Urgency bias: Fake CVEs and “immediate update” language reduce skepticism.
• Automation scale: Thousands of posts appear within minutes, overwhelming defenses.

How Developers Can Protect Themselves

• Verify updates: Only download VS Code updates from official Microsoft channels.
• Check CVEs: Cross-reference advisories with trusted vulnerability databases.
• Report suspicious posts: Flag fake Discussions directly to GitHub.
• Educate teams: Train developers to spot phishing inside collaboration platforms, not just email.

Final Thought

This campaign highlights a new frontier in phishing: attackers weaponizing trusted developer platforms to deliver malware. Security awareness must evolve beyond email inboxes to include the collaborative spaces where developers spend their time.