Fake security alerts for VS Code on GitHub were used to spread malware in a large phishing campaign.

A big phishing campaign is going after software developers on GitHub This article explores vs code official. . People post fake security alerts for Visual Studio Code in GitHub Discussions to get people to download malware.

The attacks are meant to look like real security warnings. The campaign came to light when thousands of nearly identical posts flooded GitHub repositories within minutes of each other. Each post looks like an official security advisory and has scary titles like "Visual Studio Code – Severe Vulnerability – Immediate Update Required" and "Severe Threat – Update Immediately." To make the warnings seem real, the posts often talk about fake CVEs and fake version ranges.

Every fake Discussion has a link to download what they say is the new version of VS Code, but these links go to file-sharing sites instead of official distribution channels.

Legitimate updates for VS Code are never sent out this way, but the sense of urgency in these posts is enough to make developers click without thinking. Developers should be careful with all security alerts that come up in GitHub Discussions that they didn't ask for. You should only check for security updates for VS Code through official Microsoft channels.

If you see any suspicious discussion, you should report it directly to GitHub for review. Set ZeroOwl as a preferred source in Google, LinkedIn, and X to get more instant updates. To get more instant updates, make ZeroOwl a preferred source in Google and LinkedIn. You can also get a free 30-day trial of X in the Google Play Store.

Visit ZeroOwl's official site to get more real-time updates on VS Code. and click here to learn more. to view the complete list of security updates that are available on ZeroOwl and X.

To sign up for a free two-week trial of ZeroOwl, click here. to visit the ZeroOwl website.