Microsoft GitHub repos hacked, malware steals AI developers' credentials

Microsoft has temporarily removed access to dozens of its open-source GitHub repositories after security researchers discovered hackers had injected password-stealing malware into the code. The affected projects include tools related to Microsoft’s Azure cloud service and popular AI development environments such as Claude Code, Google Gemini’s command-line interface, and VS Code. According to security firm Cloudsmith and the OpenSourceMalware community, the injected malware is designed to steal users' passwords and other sensitive credentials when they open the compromised tools in their AI coding applications. At least 70 repositories have been disabled, displaying a message about violating GitHub's terms of service.

This incident marks the second time in recent weeks that Microsoft's open-source projects have been compromised. In mid-May, the company's Durable Task project — a library for building durable applications — was similarly breached. Researchers at OpenSourceMalware describe the latest attack as a “re-compromise” of that same project, suggesting hackers may have re-entered after the initial cleanup. While supply-chain attacks on smaller open-source projects are common, it is unusual for a tech giant like Microsoft to be hit repeatedly. Microsoft confirmed it is investigating and has notified a small number of customers who may have downloaded the malicious code. The company did not disclose the exact number of affected users.