Fake VS Code Security Alerts on GitHub Used to Push Malware in Widespread Phishing Campaign

A large-scale phishing campaign flooded GitHub Discussions with fake Visual Studio Code security advisories that urged developers to download a "patched" version via external links; links routed victims through Google share endpoints and attacker infrastructure (notably drnatashachinn.com) where browser fingerprinting and obfuscated JavaScript profiled users before delivering malware or phishing payloads. The posts used newly created/low-activity accounts, mass-tagging, and fabricated CVEs to amplify reach and exploit GitHub's notification system; developers are advised to only obtain VS Code updates from official Microsoft channels and report suspicious Discussions to GitHub.