A large-scale operation is targeting GitHub developers by posting bogus Visual Studio Code (VS Code) security warnings in project Discussions, with the goal of tricking users into downloading malicious software.

The deceptive posts resemble authentic vulnerability disclosures with titles like “Critical Vulnerability – Immediate Update Needed,” and often include fabricated CVE IDs and a sense of urgency.

In many instances, those behind the attacks are pretending to be real code maintainers or researchers to appear credible.

Socket, an application security firm, believes this is a highly organized campaign rather than a small, isolated attack.

The discussions are posted automatically from new or inactive accounts across thousands of repositories very quickly, triggering email alerts to many tagged users and followers.

“Initial investigations reveal thousands of almost identical posts across numerous repositories, indicating a widespread spam operation,” Socket researchers stated in a report this week.

“Because GitHub Discussions send email notifications to participants and observers, these posts also arrive directly in developers’ mailboxes.”

The messages contain links to what are claimed to be patched versions of the compromised VS Code extensions, hosted on outside platforms like Google Drive.

While Google Drive is clearly not the official distribution channel for VS Code extensions, its reputation as a trustworthy service may cause users acting quickly to overlook the warning.

Clicking the Google Drive link initiates a series of redirects that ultimately send victims to drnatashachinn[.]com, which executes a JavaScript code to gather system information.

This script collects data such as the victim’s timezone, language, user agent, OS specifics, and automation indicators. This information is then sent to the command-and-control server.

This acts as a traffic distribution system (TDS) to identify and filter out bots and security researchers, delivering the malicious payload only to verified targets.

Socket was unable to analyze the final malicious component, but noted that the JS script doesn’t deliver it immediately, nor does it attempt to steal credentials.

This isn’t the first time malicious actors have exploited GitHub’s notification features to spread phishing scams and malware.

In March 2025, a widespread phishing campaign targeted 12,000 GitHub repositories with fake security alerts, attempting to trick developers into approving a malicious OAuth app that granted attackers access to their accounts.

In June 2024, attackers abused GitHub’s email system using spam comments and pull requests on repositories, leading victims to phishing sites.

When encountering security alerts, users should always confirm vulnerability identifiers using authoritative sources, such as the National Vulnerability Database (NVD), CISA’s Known Exploited Vulnerabilities catalog, or MITRE’s Common Vulnerabilities and Exposures program website.

They should also carefully consider the validity of alerts before taking action, and look for suspicious signs like external download links, unverified CVEs, and mass tagging of unrelated users.