One-Click GitHub Dev Attack Lets Attackers Steal Full GitHub OAuth Tokens
Cybersecurity researchers have disclosed a one-click attack via Microsoft Visual Studio Code (VS Code) that makes it possible to steal a user's GitHub token. "Just by clicking a link, it's possible for an attacker to steal a GitHub token that can read and write to your repos, including private ones," security researcher Ammar Askar said. GitHub supports a feature called GitHub.dev that runs as
Client-side OAuth redirect abuse in VS Code's GitHub.dev integration — token is exfiltrated silently with no user consent prompt. Immediate actions: audit third-party VS Code extensions holding GitHub auth scopes, rotate tokens for CI bots and service accounts, and flag any GitHub sessions open on shared/developer workstations. Attack surface is anyone who clicks a crafted link while VS Code is active.
Cybersecurity researchers have disclosed a one-click attack via Microsoft Visual Studio Code (VS Code) that makes it possible to steal a user's GitHub token. "Just by clicking a link, it's possible for an attacker to steal a GitHub token that can read and write to your repos, including private ones," security researcher Ammar Askar said. GitHub supports a feature called GitHub.dev that runs as