A large-scale campaign is targeting developers by abusing GitHub Discussions to spread fake Visual Studio Code (VS Code) security alerts.
The goal is simple — create urgency, build trust, and trick developers into downloading malware.
What’s happening?
Threat actors are posting fake vulnerability advisories across thousands of GitHub repositories.
These posts look highly convincing, using:
- 🚨 Titles like “Severe Vulnerability – Immediate Update Required”
- Fake CVE identifiers
- Urgent, security-focused language
- Impersonation of real maintainers or researchers
👉 The result: developers believe they’re responding to a legitimate security issue.
Why this campaign is dangerous
This isn’t a small or targeted attack.
According to security researchers, it’s a coordinated, automated operation:
- Thousands of nearly identical posts
- Spread across repositories within minutes
- Created using low-activity or newly created accounts
Even more concerning:
👉 GitHub Discussions trigger email notifications
This means the phishing messages are delivered directly to:
- Repository watchers
- Contributors
- Developers’ inboxes
The infection chain
The attack uses a multi-stage approach:
1. Fake security alert
Developers see a “critical vulnerability” post
2. Malicious download link
Victims are directed to “patched versions” of VS Code extensions
- Hosted on platforms like Google Drive
- Appears trustworthy at first glance
3. Redirect & profiling
Clicking the link triggers a redirection chain to attacker-controlled infrastructure
A JavaScript payload collects:
- Timezone and locale
- Operating system details
- Browser and user agent
- Indicators of automation (to filter bots/researchers)
4. Target filtering (TDS)
Only “valid” victims receive the next stage payload
👉 This makes detection and analysis significantly harder
A familiar pattern
This is not the first time GitHub has been abused:
- March 2025:
Fake alerts tricked developers into authorizing malicious OAuth apps - June 2024:
Spam comments and pull requests redirected users to phishing pages
👉 GitHub’s trusted notification system is increasingly being weaponized
Why developers are targeted
Developers are high-value targets because they often have:
- Access to source code
- Credentials and API keys
- Deployment pipelines
- Sensitive infrastructure
👉 A single compromised developer can lead to supply chain attacks
How to stay protected
1. Verify CVEs
Always check vulnerability IDs against:
- NVD (National Vulnerability Database)
- CISA Known Exploited Vulnerabilities
- MITRE CVE database
2. Avoid external download links
Legitimate VS Code extensions are not distributed via Google Drive
3. Watch for red flags
- Mass tagging of users
- Newly created accounts
- Urgent “fix now” language
- Unverified security claims
4. Pause before acting
Attackers rely on urgency and panic
Take a moment to validate before clicking anything
Key takeaway
This campaign highlights a growing trend:
Attackers are no longer breaking platforms — they’re abusing trust within them.
Even trusted ecosystems like GitHub can become distribution channels for malware.
