Microsoft Fixes One-Click GitHub Dev Attack That Let Attackers Steal OAuth Tokens

Summary: A researcher disclosed a one-click attack through GitHub.dev, the browser-based VS Code editor, in which malicious JavaScript in an untrusted webview simulates keypresses to open the Command Palette and install an attacker-controlled extension that extracts the GitHub OAuth token. The token is not scoped to a single repository, so it grants read and write access to every repo the victim can reach, including private ones; GitHub was notified on June 2, 2026, and Microsoft said the issue was addressed on June 3, 2026, at 7:30 a.m. PST with no customer action required.
What's compelling: The stolen OAuth token carries full access to every repository the victim can reach, not just the one they clicked on, and the install path skipped the trusted publisher check by placing the extension in the workspace's .vscode/extensions folder.

Read the original at The Hacker News ↗