GitHub Updates Security Incident: Employee Device Compromised via Malicious VS Code Extension

ChainCatcher report: GitHub has updated its investigation details regarding the unauthorized access incident to internal repositories: Yesterday, GitHub detected and contained an incident involving a compromised employee device, which was infected via a malicious VS Code extension. GitHub removed the malicious extension, isolated affected endpoints, and immediately initiated its incident response. Current assessments indicate that data exfiltration occurred only from GitHub’s internal repositories; the attacker’s claim of approximately 3,800 repositories aligns closely with the investigation findings. GitHub has prioritized rotating critical credentials, is analyzing logs, verifying credential rotation, and monitoring for further activity, and will release a full report upon completion of the investigation. Additionally, 23pds, Chief Information Security Officer at SlowMist, posted regarding this incident: “Analyzing leaks on cybercrime forums suggests that hackers may have used Anthropic’s Mythos security AI to precisely breach GitHub’s defenses and steal around 4,000 core internal repositories containing source code for Copilot, CodeQL algorithms, Actions runtime, and the entire billing system. Further analysis of this code could enable additional attacks and have profound security implications for the broader open-source community.”