Fake VS Code security alerts flood GitHub Discussions to lure developers to malware

In late March 2026 application security firm Socket reported a large, automated campaign that posted fake Visual Studio Code security alerts in the Discussions tab of thousands of GitHub repositories. Because the posts tagged many users, GitHub's own notification emails carried the lure straight to developers' inboxes. This campaign abuses GitHub's trusted notification channel rather than any software flaw, and it isn't the first.

What happened

Socket described thousands of near-identical Discussions posts created within minutes from new or low-activity accounts. The posts had urgent titles such as "Severe Vulnerability - Immediate Update Required", cited CVE identifiers that don't exist, and sometimes impersonated real maintainers or researchers. Each post urged readers to install a "patched" version of an affected VS Code extension.

The download links pointed to Google Drive. Clicking through started a cookie-based redirect chain ending at drnatashachinn[.]com, where a JavaScript reconnaissance script collected the visitor's timezone, locale, user agent, operating system and signs of automation, then POSTed them to the attacker's server. Socket described this stage as a traffic distribution system: it filters out bots and researchers and serves the next stage only to visitors who look like real targets. Socket didn't capture the second-stage payload, so what it finally installs is unknown.

BleepingComputer, which reported the research on 27 March 2026, pointed to earlier abuse of the same channel: a March 2025 campaign that sent fake security alerts to about 12,000 repositories to trick developers into authorising a malicious OAuth app, and a June 2024 wave of spam comments and pull requests that triggered GitHub emails pointing to phishing pages.

Who is affected

• Developers who use VS Code and follow or are tagged in GitHub projects. Mentions and Discussions activity generate email notifications from GitHub itself.
• Maintainers of repositories with Discussions enabled, whose project pages were used to host the spam.
• Organisations whose developers can install extensions from arbitrary sources on machines that hold source code and credentials.

What it means for developers and engineering teams

The lure works because it imitates a process developers trust: a security advisory followed by an urgent update. But real VS Code extension updates don't arrive that way. Extensions installed from the Visual Studio Marketplace (or Open VSX in other editors) update through the editor itself. A post that asks you to download an extension package from Google Drive or a personal site is a strong warning sign. A CVE ID you can't find in NVD, the CVE.org list or the GitHub Advisory Database is another.

The "filter first, then deliver" design is also worth understanding. Because the landing page only fingerprints the visitor, automated URL scanners and sandboxes see a harmless script, which helps the link survive reputation checks. Defences that rely on detonating the URL will miss it. Policy controls (which extensions can be installed, from where) and user scepticism do better.

Extensions run with the same rights as the editor: they can read your workspace, your environment variables and the tokens your Git and cloud tools cache. A malicious extension on a developer machine can do as much damage as a malicious dependency in production.

What to do now

1. Verify before acting. Look up any CVE in NVD, CISA's Known Exploited Vulnerabilities catalog or the GitHub Advisory Database, and check the extension's Marketplace page and official repository for a matching advisory.
2. Never install extension packages (.vsix) from links in issues, Discussions or email. Update from inside the editor.
3. Audit what's installed: run code --list-extensions --show-versions and remove anything you don't recognise or no longer use.
4. Restrict extensions centrally. Recent VS Code releases support an extensions.allowed setting that can be enforced through device management policy to allowlist publishers or specific extensions.
5. Maintainers: turn off Discussions if you don't use them, use GitHub's temporary interaction limits during a spam wave, and report and delete the posts and accounts.
6. Tune notifications so mentions from accounts you don't know are easy to triage, and treat urgent "security update" emails from GitHub about third-party software with suspicion.

Related on TechLogHub

• VS Code vs JetBrains: editors and their extension ecosystems
• GitHub vs GitLab vs Bitbucket: hosting platforms compared
• OAuth: the target of the 2025 fake-alert campaign

Sources

• BleepingComputer: Fake VS Code alerts on GitHub spread malware to developers
• TechRadar: GitHub developers targeted by fake VS Code alerts spreading malware
• Techzine: Major phishing campaign on GitHub using fake security alerts