GitHub fake VS Code alert spam campaign
Campaign
Summary
Hide ▲
Show ▼
A coordinated GitHub Discussions spam campaign is posting fake Visual Studio Code security alerts to lure developers into malware downloads, reaching thousands of repositories and inboxes. The posts use urgent advisory language, fake CVE IDs, and impersonation of maintainers or researchers to look legitimate. Automated accounts also trigger notification emails to tagged users and followers, widening exposure beyond the repository page. The lure chain sends victims through Google Drive to drnatashachinn[.]com, where a JavaScript reconnaissance script profiles the target before any second stage is delivered.
Related Happenings
GemStuffer RubyGems data-exfiltration campaign
Campaign
H score29
First: 13.05.2026 11:08
Last: 13.05.2026 11:08
Sources 1
About this happening:
The GemStuffer campaign is abusing RubyGems as a data-exfiltration channel, with more than 150 gems used to stage scraped content. It targeted public-facing ModernGo...
GemStuffer RubyGems data-exfiltration campaign
CampaignAbout this happening: The GemStuffer campaign is abusing RubyGems as a data-exfiltration channel, with more than 150 gems used to stage scraped content. It targeted public-facing ModernGo...
Google sponsored search ManageWP phishing campaign
Campaign
H score13
First: 07.05.2026 00:36
Last: 07.05.2026 00:36
Sources 1
About this happening:
A phishing campaign is abusing Google sponsored search results to impersonate ManageWP and steal login credentials, 2FA codes, and account access. The operation ma...
Google sponsored search ManageWP phishing campaign
CampaignAbout this happening: A phishing campaign is abusing Google sponsored search results to impersonate ManageWP and steal login credentials, 2FA codes, and account access. The operation ma...
SEO-poisoned GitHub facade campaign targeting enterprise admin tools
Campaign
H score39
First: 30.04.2026 14:30
Last: 30.04.2026 14:30
Sources 1
About this happening:
A high-resilience SEO-poisoning campaign is pushing malicious MSI installers through dual-stage GitHub facades, raising the risk that enterprise admins and security st...
SEO-poisoned GitHub facade campaign targeting enterprise admin tools
CampaignAbout this happening: A high-resilience SEO-poisoning campaign is pushing malicious MSI installers through dual-stage GitHub facades, raising the risk that enterprise admins and security st...
Claude Code leak GitHub Vidar lure campaign
Campaign
H score32
First: 02.04.2026 23:30
Last: 02.04.2026 23:30
Sources 1
About this happening:
A malicious GitHub repository campaign is abusing the Claude Code leak to deliver Vidar to users searching for leaked code. The lure uses a fake leak, search-eng...
Claude Code leak GitHub Vidar lure campaign
CampaignAbout this happening: A malicious GitHub repository campaign is abusing the Claude Code leak to deliver Vidar to users searching for leaked code. The lure uses a fake leak, search-eng...
TroyDen's Lure Factory GitHub Trojanized package campaign
Campaign
H score41
First: 24.03.2026 16:59
Last: 24.03.2026 16:59
Sources 1
About this happening:
The TroyDen's Lure Factory campaign is distributing 300+ Trojanized GitHub packages, broadening supply-chain risk for developers, gamers, and the general public. One o...
TroyDen's Lure Factory GitHub Trojanized package campaign
CampaignAbout this happening: The TroyDen's Lure Factory campaign is distributing 300+ Trojanized GitHub packages, broadening supply-chain risk for developers, gamers, and the general public. One o...
Timeline
-
27.03.2026 18:51 2 articles · 3mo ago
Fake VS Code alerts target GitHub developers
Initial DisclosureSecurity researchers identified a large-scale GitHub Discussions spam campaign that impersonates maintainers or researchers and posts fake Visual Studio Code security alerts with urgent vulnerability-advisory language and fake CVE IDs, pushing developers toward external download links on Google Drive and a cookie-driven redirect chain to drnatashachinn[.]com that runs a JavaScript reconnaissance script.
Show sources
- Fake VS Code alerts on GitHub spread malware to developers — www.bleepingcomputer.com — 27.03.2026 18:51
- Fake VS Code alerts on GitHub spread malware to developers — www.bleepingcomputer.com — 27.03.2026 18:51