Microsoft GitHub Open Source Projects Hacked to Steal Developer Passwords
Microsoft has
cut off access to dozens of its open source projects hosted on GitHub after
investigating a breach in which hackers injected password-stealing malware into
the code. The targeted projects are widely used by AI developers and software
engineers, making the supply chain attack particularly dangerous given the
potential for wide-scale credential theft.
The attackers
reportedly compromised the build pipelines of several projects, inserting
malicious code that captures developer credentials and exfiltrates them to
attacker-controlled servers. This technique — known as a supply chain attack —
is especially insidious because it targets trusted code repositories, meaning
developers installing legitimate-seeming packages inadvertently install
malware.
According to
the IBM X-Force Threat Intelligence Index 2026, major supply chain and
third-party breaches have quadrupled over the past five years. The incident is
consistent with a broader trend of attackers targeting development ecosystems
and trusted infrastructure as an indirect route into enterprise environments.
Microsoft has
urged all developers who cloned or installed affected packages to rotate their
credentials immediately and audit their development environments for signs of
compromise. Security experts recommend organizations adopt software composition
analysis tools and implement code signing to detect unauthorized modifications.
Comments