TLDR Tech / IT
Fake VS Code Alerts on GitHub Spread Malware to Developers
Attackers are posting fake VS Code vulnerability alerts across GitHub Discussions, using spoofed CVEs, impersonation, and mass tagging to trick developers into downloading malware from external links. The campaign is highly automated and leverages GitHub notifications to reach users directly, showing how trusted developer platforms are being weaponized to deliver malware at scale.
Read the full story