Fake VS Code Security Alerts on GitHub Spread Malware in Massive Phishing Attack

A large-scale phishing campaign is abusing GitHub Discussions to post templated fake VS Code security alerts (including fabricated CVEs) that trigger built-in GitHub notifications and direct developers to Google-hosted redirects and an attacker-controlled domain (drnatashachinn.com). The landing flow performs browser fingerprinting and uses a Traffic Distribution System to profile and selectively route victims to secondary stages (phishing pages or exploit kits); attackers use JavaScript obfuscation, environment checks, and rapid automated posting to scale and evade detection.