Title: GitHub Hit by Fake VS Code Alerts Pushing Malware Lead: GitHub is targeted by a coordinated spam campaign posting fake VS Code security advisories in Discussions to trick developers into malware downloads.

A large-scale phishing campaign has hit GitHub, targeting software developers by utilizing fake Visual Studio Code security alerts. These alerts mimic legitimate advisories, urging developers to download a “patched” version via a misleading link. The phishing scheme has surfaced with thousands of nearly identical posts in GitHub repositories, creating the illusion of urgency and legitimacy by using phrases like “Severe Vulnerability – Immediate Update Required.” Researched by Socket.dev analysts, these posts are generated from new or low-activity accounts, aiming for broad distribution by exploiting GitHub’s notification system to reach developers’ inboxes. The fake alerts include links to file-sharing services instead of official sources, emphasizing the need for vigilance. The phishing tactics involve multi-step redirections and browser fingerprinting, enhancing the operation’s stealth. Developers must scrutinize unsolicited alerts and verify updates through Microsoft channels. For further details, read the full article on the impact of this GitHub hit:

Fake VS Code Security Alerts on GitHub Used to Push Malware in Widespread Phishing Campaign