Github login screen looks like a phishing attempt

[resnickj]

Type: Bug

1. Click "Sign-in with Microsoft to use C# Dev Kit".
2. Click "Sign in with Github".
3. Observe the screen that appears. There is no way I'm entering my Github credentials into that. I would expect to have been redirected to an actual Github login screen for oauth.

Extension version: 3.10.14
VS Code version: Code 1.129.0 (125df4672b8a6a34975303c6b0baa124e560a4f7, 2026-07-15T00:08:44Z)
OS version: Windows_NT x64 10.0.26200
Modes:

System Info

Item	Value
CPUs	AMD Ryzen AI 9 HX 370 w/ Radeon 890M (24 x 1996)
GPU Status	2d_canvas: enabled GPU0: VENDOR= 0x1002, DEVICE=0x150e [AMD Radeon(TM) 890M Graphics], DRIVER_VENDOR=AMD, DRIVER_VERSION=32.0.13058.2 ACTIVE GPU1: VENDOR= 0x1414, DEVICE=0x008c [Microsoft Basic Render Driver], DRIVER_VERSION=10.0.26100.8875 Machine model name: Machine model version: direct_rendering_display_compositor: disabled_off_ok gpu_compositing: enabled multiple_raster_threads: enabled_on opengl: enabled_on rasterization: enabled raw_draw: disabled_off_ok skia_graphite: disabled_off trees_in_viz: disabled_off video_decode: enabled video_encode: enabled webgl: enabled webgpu: enabled webnn: disabled_off
Load (avg)	undefined
Memory (System)	31.12GB (16.55GB free)
Process Argv	--crash-reporter-id 544eeefa-b70a-4a4b-921c-a4129c2b930a
Screen Reader	no
VM	0%

A/B Experiments

vsliv368cf:30146710
binariesv615:30325510
nativeloc1:31344060
dwcopilot:31170013
dwoutputs:31242946
copilot_t_ci:31333650
e5gg6876:31282496
pythonrdcb7:31342333
6518g693:31463988
aj953862:31281341
63221493:31336333
envsactivate1:31551504
cloudbuttont:31379625
3efgi100_wstrepl:31403338
ddidtcf:31399634
ec5jj548:31422691
cp_cls_t_966_ss:31526232
4je02754:31466945
8hhj4413:31478653
38bie571_auto:31426784
cp_cls_c_1081:31454833
conptydll_true:31498968
e9c30283:31461165
test_treatment2:31471001
c9b86496:31447327
capico_a_098a3278:31551523
idci7584:31464702
e3e4d672:31494082
ei9d7968:31496641
chat:31457767
8hig5102:31480529
89g7j272:31518289
7e187181:31503455
i2gc6536:31499202
52612955:31516516
ghj88844:31499326
ec1eg703:31520046
ddid_t:31478206
hmra_i5g22:31518061
7df3h592:31512476
cp_cls_t_1082:31535311
logging_enabled_new:31498466
db5d2638:31499441
jb_cp_cls_t_632:31543129
852d2892:31506239
748c7209:31512887
32d76977:31512328
ha629193:31508444
cdk-lw-on:31524445
f9bf7985:31543584
jh5f2457_c:31540921
41836166:31537719
jbcp_cls_pctr_t:31531130
61138546:31518536
cp_intellij_t_nes:31548657
jf4hg949:31526829
nes-curr-leftover-1500:31538366
h561g132:31533256
sessions_3:31532893
ihg5j128:31534457
f412h606:31551416
7g2b5551:31542111
nes-ex-cf-euporie-03:31542868
7642ad28:31551796
fd5dc207:31551400

[claudiaregio]

@AndreyTretyak do you have any thoughts on this one? I need guidance on what folder to delete to remove the cache since I've been signed in for a while to try to repro. I'm not sure if this is us or an actual phishing attempt or could be as simple as a specific font being missing from a user's machine and defaulting to an available one like Times New Roman...?