CERT24VS Code zero-day lets hackers steal GitHub tokens in one clickLoading data…
CERT24Threat Observatory
Period

VS Code zero-day lets hackers steal GitHub tokens in one click

A security researcher released proof-of-concept and exploit code for a Visual Studio Code zero-day vulnerability. By tricking a user into clicking a link, an attacker can install a malicious extension, steal a GitHub OAuth token passed to github.dev, and enumerate all private repositories accessible to the victim.

← Back to intelligence

VS Code zero-day lets hackers steal GitHub tokens in one click

A security researcher released proof-of-concept and exploit code for a Visual Studio Code zero-day vulnerability. By tricking a user into clicking a link, an attacker can install a malicious extension, steal a GitHub OAuth token passed to github.dev, and enumerate all private repositories accessible to the victim.