Attackers planted credential-stealing malware in Microsoft's open-source dev tools
The tools developers trust became the attack surface: Microsoft cut off access to dozens of its open-source GitHub projects after attackers injected credential-stealing malware into the code. Many of the compromised tools touch Azure and AI coding workflows — used alongside Claude Code, Gemini's CLI, and VS Code — and harvested developers' passwords and tokens when the poisoned tools ran. Researchers who flagged it suspect a link to an earlier breach of Microsoft's Durable Task project in May.
Why it matters: This is a textbook software-supply-chain attack, but the target selection is the story — the malware went where the credentials are richest, which is now the AI developer's toolchain, sitting on cloud tokens and API keys. The uncomfortable implication is that the AI coding workflow has quietly become high-value terrain: pull in a compromised dependency and the same tokens that let your agent deploy to Azure are exactly what the attacker wants. The suspected link back to May's Durable Task breach suggests persistence rather than a one-off, which is the pattern of an adversary who understands that developer machines are a lateral-movement goldmine. The broader trend it accelerates: as we wire agents and CLIs deeper into production with standing credentials, the blast radius of a single poisoned tool grows, because the tool doesn't just run code — it runs code with your permissions. The practical takeaway isn't panic, it's hygiene that most teams still skip — pin dependencies, scope tokens narrowly, rotate aggressively, and treat every tool your agent invokes as code you're choosing to trust.