Threat Intelligence
@threatintel
#ThreatProtection GhostAction now phishes open-source maintainers with fake GitHub sign-in alerts to steal credentials, 2FA codes and OAuth tokens. Read more about Symantec’s protection: t.co/GN7LOBQNZj
VS Code
Security incidents tagged VS Code. Newest first.
- Incidents
- 3
- Live
- 1
- Patched
- 2
- Days without an incident
- 0
- Longest quiet run: 182 days (Mar 2–Aug 30)
- LiveHighPartly patched
GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos
GhostAction, a campaign first documented by GitGuardian in Sept 2025, came back in 2026. It hit 772 repos in Aug-Sep 2026, then surged on Oct 8-12: about 1,900 compromised GitHub accounts pushed fake 'security audit' workflows to 30,000+ repositories (GitGuardian). The new payload exfiltrates the repo's Actions secrets plus every credential found in the full git history to 193.32.204.199 over plain HTTP. GitHub began preventing the workflow from running around Oct 9. The operator moved on to GitHub-themed phishing (my-github.com) and a VS Code tasks.json + fake .woff2 font stealer found in 94 repos.
GitHub repositories / GitHub Actions (compromised maintainer accounts)Since Oct 8, 2026
Show 2 older incidents2 older incidents
March 2026 1
CriticalTeamPCP supply-chain campaign: Trivy → Checkmarx GitHub ActionsPatched
Aqua Trivy, trivy-action, setup-trivy, Checkmarx AST/KICS GitHub Actions, related Docker/VS Code artifacts Patched
Threat actors tracked as TeamPCP compromised Trivy releases and GitHub Actions (including trivy-action / setup-trivy), then expanded into Checkmarx AST and KICS Actions and related artifacts. Malware stole CI/CD credentials (exfil as tpcp.tar.gz). Microsoft, Sysdig, CSA Singapore and Checkmarx published guidance in March 2026.
October 2025 1
HighGlassWorm: self-spreading VS Code / OpenVSX extension worm hidden in invisible UnicodePatched
VS Code extensions on OpenVSX and the VS Code Marketplace Patched
Koi Security found extensions on OpenVSX (and one on Microsoft's marketplace) carrying JavaScript hidden in invisible Unicode variation selectors. The malware stole npm, GitHub, Git and OpenVSX credentials to infect more extensions, went after crypto wallets, and set up SOCKS proxies and hidden VNC.
2 VS Code incidents in the last 12 months
Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore
