Hackers Steal GitHub Tokens in One Click using VSCode

Overview A newly disclosed zero‑day vulnerability in Visual Studio Code (VS Code) has exposed developers to a serious GitHub token theft risk. Security researcher Ammar Askar released exploit code demonstrating how attackers can steal GitHub OAuth tokens by tricking users into clicking a malicious link — a flaw that remains unpatched and without a CVE ID.

Microsoft defines a zero‑day as a flaw that is publicly disclosed or exploited before an official fix exists, making this vulnerability particularly dangerous for developers who rely on VS Code’s integrated GitHub features.

Exploit Mechanism

The vulnerability abuses VS Code’s sandboxed webview message‑passing system, allowing malicious extensions to intercept tokens sent to github.dev — the browser‑based version of VS Code used for editing GitHub repositories.

Stage	Technique	Impact
Malicious Link Click	User clicks crafted URL	Triggers webview execution
Webview Injection	JavaScript runs inside sandbox	Simulates keypresses to install extension
Token Extraction	Extension captures OAuth token	Full access to private repositories
API Enumeration	Queries GitHub API	Lists all repos accessible to victim

Askar explained:

“The token is not scoped to the particular repo you interacted with, meaning it has full access to every other repo that you have access to.”

This means a single click can compromise all private repositories linked to a developer’s GitHub account.

Researcher Disclosure

Askar notified GitHub one hour before public release, citing frustration with Microsoft’s Security Response Center (MSRC). He stated that previous VS Code bugs were silently fixed without credit or acknowledgment of their security impact.

“Going forward I would be doing full public disclosure for any security bugs I found in VS Code,” Askar wrote.

This disclosure follows a wave of Microsoft zero‑days revealed by the anonymous researcher Nightmare Eclipse, who previously exposed BlueHammer, RedSun, GreenPlasma, MiniPlasma, YellowKey, and UnDefend vulnerabilities — several of which are now being exploited in the wild.

Mitigation Steps

Until Microsoft releases a patch, VS Code users should:

• Clear cookies and site data for github.dev via browser settings.
• Revoke GitHub tokens and re‑authenticate securely.
• Avoid clicking untrusted links shared via email or chat.
• Monitor repository access logs for suspicious API queries.
• Restrict extension permissions and disable unverified plugins.

These steps ensure users receive a “GitHub Repositories wants to sign in” prompt before any token exchange, blocking silent exploitation.

Expert in the Cloud Insight

The VS Code zero‑day highlights the growing risk of developer toolchain exploitation. As integrated IDEs and cloud editors become central to software development, attackers are shifting focus from end‑users to developers themselves — the gatekeepers of source code and credentials.

For enterprises, the lesson is clear: developer security is enterprise security. Continuous monitoring, strict extension policies, and zero‑trust principles must extend to every developer environment.