Hackers slipped password-stealing malware into Microsoft’s open-source dev tools

Microsoft cut off access to dozens of its open-source GitHub projects after attackers injected credential-stealing malware into the code. Many of the affected tools relate to Azure and to AI coding workflows — used alongside apps like Claude Code, Gemini’s CLI, and VS Code — and the malware harvested developers’ passwords and tokens when the compromised tools ran. Researchers who flagged it suspect a link to an earlier breach of Microsoft’s Durable Task project in May.