# VS Code Zero-Day Exploit: Stealing GitHub Tokens via URI Handlers

> Security researcher mthcht reveals a VS Code zero-day vulnerability allowing GitHub token theft via URI handlers. Learn how to defend against this exploit.

- Published: 2026-06-03T09:45:04.000Z
- Severity: high
- Category: Vulnerabilities
- Tags: Visual Studio Code, Github Token Theft, Zero-Day, Uri Handlers, Phishing
- Author: Runtime Rebel Intel
- Primary source: https://www.bleepingcomputer.com/news/security/vs-code-zero-day-lets-hackers-steal-github-tokens-in-one-click/
- Canonical: https://runtimerebel.com/blog/vs-code-zero-day-exploit-stealing-github-tokens-via-uri-handlers

## Key points

- Immediate impact: Attackers can exfiltrate GitHub authentication tokens by tricking users into clicking a malicious link that interacts with VS Code URI handlers.
- Affected systems: Visual Studio Code installations across all platforms are vulnerable when specific authentication extensions or URI handlers are triggered.
- Remediation: Organizations should implement strict extension whitelisting and train developers to scrutinize authentication requests from external links.

## Overview of the Visual Studio Code Zero-Day

A [Zero-Day](/glossary#zero-day) vulnerability in Visual Studio Code (VS Code) has been disclosed, potentially allowing attackers to exfiltrate sensitive GitHub authentication tokens. This flaw centers on the way the application processes custom URI handlers, specifically those associated with authentication providers. According to [BleepingComputer](https://www.bleepingcomputer.com/news/security/vs-code-zero-day-lets-hackers-steal-github-tokens-in-one-click/), a security researcher known as mthcht released a proof-of-concept (PoC) demonstrating how a single click on a malicious link can compromise developer credentials.

While Microsoft has reportedly been made aware of the issue, no [CVE](/glossary#cve) has been formally assigned at the time of writing. The researcher chose to disclose the technical details after determining that the behavior could be weaponized via [Phishing](/glossary#phishing) to gain unauthorized access to private repositories and corporate infrastructure.

## Technical Analysis: Visual Studio Code GitHub Token Theft Exploit

The vulnerability leverages the application's deep-linking capabilities, which allow external applications or websites to trigger specific actions within the editor. The **Visual Studio Code GitHub token theft exploit** relies on the `vscode-auth://` protocol handler. By crafting a specialized URL, an attacker can initiate an authentication flow that, if accepted or automatically processed, redirects the resulting OAuth token to an attacker-controlled endpoint.

### Exploiting URI Handlers for Token Exfiltration

The attack vector involves a two-stage process. First, the attacker must persuade the target to click a link, often disguised as a legitimate collaboration request or a repository link. When the browser invokes the VS Code protocol handler, the application attempts to resolve the authentication request through the integrated GitHub provider. If the developer is already authenticated, the system may inadvertently bypass certain warnings, depending on the specific extension configuration and the state of the session.

This mechanism allows for the silent exfiltration of tokens that possess broad permissions, including read/write access to private source code. For an organization, this represents a significant [Supply Chain Attack](/glossary#supply-chain-attack) risk, as compromised tokens can be used for [Lateral Movement](/glossary#lateral-movement) within a GitHub organization, enabling the injection of malicious code into production branches.

## How to Detect VS Code URI Handler Exploitation

Detecting this [TTP](/glossary#ttp) requires monitoring both the host operating system and network traffic. Security teams should configure their [SIEM](/glossary#siem) or [EDR](/glossary#edr) solutions to flag unusual process execution patterns where the VS Code executable is launched with the `vscode-auth://` or `vscode://` arguments from a web browser process (e.g., chrome.exe or firefox.exe).

To effectively implement a strategy on **how to detect VS Code URI handler exploitation**, [SOC](/glossary#soc) analysts should look for specific indicators of compromise, such as:

*   Outbound network connections from the VS Code process to unfamiliar external domains immediately following a URI handler invocation.
*   Registry modifications or configuration changes related to the `vscode-auth` protocol registration.
*   Suspicious GitHub audit logs showing token generation or access from anomalous IP addresses or non-standard user agents.

## Mitigation and Recommendations

Until an official patch is released or a configuration change is mandated by the vendor, defenders must rely on proactive security measures. Restricting the use of third-party extensions that request high-level authentication permissions is a primary defense. Organizations should adopt a [Zero Trust](/glossary#zero-trust) approach to developer tooling, ensuring that even internal links are validated before interaction.

1.  **Restrict Extension Installations:** Use VS Code's built-in policies to allow only verified extensions from trusted publishers.
2.  **Disable Protocol Handlers:** If deep linking is not required for the workflow, consider disabling the OS-level registration for `vscode-auth://` handlers.
3.  **Developer Education:** Train staff to recognize that authentication prompts originating from a browser-to-app transition are high-risk events.
4.  **Token Rotation:** Implement aggressive expiration policies for GitHub personal access tokens and OAuth tokens to minimize the window of opportunity for an attacker.

**Related:** [GitHub Malware Campaign: Fake VS Code Alerts Target Developers](/blog/github-malware-campaign-fake-vs-code-alerts-target-developers), [Cisco Catalyst SD-WAN Controller Authentication Bypass via CVE-2026-20182 Exploited in Zero-Day Attacks](/blog/cisco-catalyst-sd-wan-controller-authentication-bypass-via-cve-2026-20182-exploited-in-zero-day-attacks)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/vs-code-zero-day-exploit-stealing-github-tokens-via-uri-handlers