Loading story…
A large-scale phishing campaign is abusing GitHub Discussions to post fake Visual Studio Code security alerts that pressure developers into downloading malware from external links. The posts impersonate legitimate advisories with fabricated CVE identifiers, fake affected version ranges, and urgent language, while newly created or low-activity accounts mass-tag developers across unrelated repositories to expand reach. Because GitHub Discussions can trigger email notifications to watchers and participants, the operation gains additional credibility and visibility beyond the platform itself.
Analysis of the linked infrastructure showed a multi-stage redirection chain that used a Google share.google endpoint and the attacker-controlled domain drnatashachinn[.]com. The delivered JavaScript performed browser fingerprinting, cookie checks, obfuscation, and anti-analysis steps to distinguish real users from bots or security scanners before routing victims to later-stage malicious content, consistent with a traffic distribution system. Researchers said the campaign appears coordinated and automated, and urged developers to treat unsolicited GitHub security alerts with external download links as suspicious and verify VS Code updates only through official Microsoft channels.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Public reporting on the campaign highlighted that GitHub Discussions can amplify the lure through email notifications and advised developers not to trust unsolicited security alerts with external download links. The guidance recommended verifying Visual Studio Code updates only through official Microsoft channels.
Analysis of a linked payload revealed a multi-step redirection chain using a Google share.google endpoint and the attacker-controlled domain drnatashachinn[.]com. The JavaScript performed browser and environment fingerprinting, anti-analysis checks, and sent results back to the endpoint, indicating a traffic distribution system used to filter victims before later-stage malicious content.
A coordinated campaign used newly created or low-activity GitHub accounts to post hundreds to thousands of near-identical fake Visual Studio Code security alerts across repositories. The posts impersonated advisories with fabricated CVEs, fake version ranges, and mass-tagging of developers to pressure them into downloading software from external links.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesocket.dev
Open sourceinfosec.pub
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors abused trusted developer distribution channels to deliver malware by impersonating popular tools. Research described a campaign that forked the **official GitHub Desktop** repository, altered README download links to point to a malicious Windows installer, and then drove victims to the poisoned links via sponsored ads targeting searches for “GitHub Desktop.” The technique leveraged GitHub behavior where commits from forks can remain visible under the upstream project’s namespace even after the attacker’s fork/account is deleted (a form of **repo squatting**), complicating takedown efforts; the observed payload (`GitHubDesktopSetup-x64.exe`, ~127.68 MB) functioned as a multi-stage loader, and similar installer-themed lures (e.g., *Chrome*, *Notion*, *1Password*, *Bitwarden*) were reported in related activity. Separately, a **fake “ClawdBot Agent” VS Code extension** was identified as a functional trojan that executed automatically on VS Code startup (`"activationEvents": ["onStartupFinished"]`) and dropped malware on Windows systems; the legitimate **Clawdbot** project reportedly had no official VS Code extension, enabling name-squatting/impersonation. The extension fetched configuration from `http://clawdbot.getintwopc[.]site/config.json` and installed a **ScreenConnect RAT**, and it was reported to Microsoft and removed. Two additional posts about *Clawdbot* focused on general SOC monitoring and broader “AI agent” security considerations rather than the specific malware/impersonation incidents.
Jun 29, 2026
Security researchers at ReversingLabs have identified a sophisticated campaign in which 19 malicious Visual Studio Code (VS Code) extensions were uploaded to the VS Code Marketplace, targeting developers by hiding a Trojan within their dependency folders. The attackers modified a widely trusted npm package, `path-is-absolute`, to include malicious code that executed upon VS Code startup, ultimately decoding a JavaScript dropper concealed in a file named `lock`. The final payload was disguised as a `banner.png` file, which, despite its image extension, was actually an archive containing two malicious binaries. This campaign, active since February 2025 and discovered in December, highlights the risks of supply chain attacks in developer ecosystems. The malicious extensions either impersonated popular packages or claimed to offer new functionalities, but in reality, they executed harmful code on developers' machines. The use of legitimate dependencies as a vector for malware delivery demonstrates an evolution in threat actor tactics, making detection more difficult. Researchers also noted a broader trend of increasing malware submissions to the VS Code Marketplace, including incidents where legitimate extensions were compromised through malicious pull requests that added harmful dependencies. This incident underscores the need for heightened scrutiny of third-party code and dependencies in development environments.
Jun 29, 2026
Security researcher Ammar Askar disclosed a zero-day in Visual Studio Code’s webview message-handling that allowed attackers to steal GitHub OAuth tokens from `github.dev` with a single malicious link. The attack abused forwarded keyboard events and simulated keypresses to cross the webview security boundary, silently install a malicious extension, and extract the token that GitHub passes to the browser-based editor. Multiple reports said the token was broadly scoped rather than limited to the repository being viewed, giving access to all repositories the victim could reach, including private repositories with read/write permissions. The exploit chain was also reported to affect desktop VS Code in some scenarios involving attacker-controlled repositories and malicious workspace content, though Microsoft said the issue did not affect VS Code Desktop and later indicated the problem had been fixed in its services. Public reporting tied the disclosure to a dispute over Microsoft’s vulnerability-handling process, with Askar saying he notified GitHub shortly before release and published proof-of-concept code without coordinated disclosure. Recommended precautions included avoiding untrusted `github.dev` links, clearing saved site data for `github.dev`, and reviewing installed extensions for suspicious additions.
Jun 29, 2026