Malware - Fake VS Code Alerts Fuel Phishing Campaign on GitHub

What Happened

A large-scale phishing campaign has emerged, targeting software developers on GitHub. Attackers are using fake security alerts for Visual Studio Code (VS Code) to deceive users into downloading malicious software. These alerts are designed to mimic legitimate security advisories, warning of critical vulnerabilities and urging developers to install a so-called "patched" version of the software.

The campaign has flooded GitHub Discussions with thousands of near-identical posts, each mimicking official advisories. Titles like "Visual Studio Code – Severe Vulnerability – Immediate Update Required" and "Critical Exploit – Urgent Action Needed" are alarming enough to catch attention. The posts reference fabricated CVEs and fake version ranges, making them appear credible and urgent.

Who's Being Targeted

This phishing attack primarily targets developers who rely on GitHub for collaboration and updates. By exploiting the platform’s notification system, attackers ensure that these fake alerts reach developers directly in their inboxes. This method significantly increases the chances of successful clicks on malicious links, as developers often trust alerts from a platform they use daily.

The posts are created by newly established or low-activity accounts, which tag numerous developers across unrelated repositories. This strategy not only maximizes exposure but also takes advantage of the trust developers place in GitHub's ecosystem.

Signs of Infection

Developers should be aware of several red flags that indicate potential phishing attempts. Signs include unsolicited security alerts in GitHub Discussions, external download links, unverifiable CVE references, and urgent installation instructions. Additionally, posts from recently created accounts or those that tag many unrelated users should raise suspicion.

The malicious links lead to file-sharing services, not official distribution channels. Legitimate updates for VS Code are never distributed this way, and the urgency in these posts often pushes developers to click without hesitation, increasing the risk of infection.

How to Protect Yourself

To safeguard against this phishing campaign, developers should treat all unsolicited security alerts with caution. Always verify security updates through official Microsoft channels. If you encounter suspicious discussions, report them directly to GitHub for review.

Moreover, be vigilant about clicking links in emails or posts that seem urgent. It’s essential to maintain a healthy skepticism towards unexpected security alerts, even from trusted platforms. Awareness and verification are key to protecting yourself from these evolving threats.