#token-theft

A vulnerability in VS Code webviews enables synthetic keyboard event injection that can be abused to steal GitHub OAuth tokens from github.dev sessions through malicious notebooks. Attackers can trigger event sequences that exfiltrate repository access tokens, affecting private repositories linked to the user’s account. Microsoft has deployed fixes limiting event propagation and adding safeguards for notebook execution environments.

Source: Recorded Future News | Ammar Askar Blog

Threat actors exploit Railway PaaS to capture Microsoft 365 OAuth device codes, stealing access and refresh tokens while bypassing multi-factor authentication controls globally.

Source: Arctic Wolf