New VS Code Zero-Day Steals GitHub Tokens in One Click

20 Просмотры

Спасибо! Поделитесь с друзьями!

Вам не понравилось видео. Спасибо за то что поделились своим мнением!

Издатель Jun 4, 2026

A security researcher just dropped working exploit code for a VS Code zero-day that steals your GitHub access token with one click. Microsoft hasn't patched it.

The flaw is in github.dev — GitHub's browser-based version of VS Code that opens when you press period on a repo. The exploit chain: the victim clicks a link to a malicious repo containing a Jupyter notebook with an HTML image tag that fires JavaScript when the image fails to load. That JavaScript waits for github.dev to prompt the user to install the repo's recommended extension, then dispatches a synthetic Control-Shift-A keypress to accept silently. The malicious extension reads the GitHub access token and ships it to the attacker in well under a minute. The token isn't scoped per repo — it can read and write to every repository the victim has access to. Researcher Ammar Askar published the disclosure on June 2nd, notifying GitHub only one hour before going public. He says the tight window was a response to past negative experiences with Microsoft's security response process. Microsoft's public comment is the standard "we remain committed to rapidly assessing reported issues" line, plus a clarification from Microsoft that the issue does not affect VS Code Desktop. Mitigation: clear cookies and local site data for github.dev in your browser settings, then stay signed out until a patch ships.

Source: https://www.bleepingcomputer.com/news/security/vs-code-zero-day-lets-hackers-steal-github-tokens-in-one-click/

More on cybersecurity, privacy, scams, and homelab on Hake Hardware. New shorts every weekday.

#cybersecurity #github #vscode #zeroday #infosec