Microsoft has disabled 73 repositories across its Azure, microsoft, Azure-Samples, and MicrosoftDocs organizations on GitHub, disrupting continuous integration pipelines after they were compromised to push password-stealing malware. The repositories were taken offline to contain the breach and protect users from malicious code.
The incident involved an information stealer injected into open-source projects hosted on GitHub. Microsoft confirmed the temporary removal in response to the security breach, with a spokesperson stating, "Our priority is to protect customers and the broader ecosystem." The full scope of affected users remains under investigation.
Technical details indicate the malware targeted CI/CD pipelines, potentially exfiltrating credentials and other sensitive data from build environments. The exact mechanism of compromise—whether through stolen credentials, supply chain attack, or insider threat—has not been disclosed. Indicators of compromise have not been publicly released.
Microsoft has begun restoring some repositories while keeping others offline as the probe continues. No specific patch or workaround has been issued as the investigation proceeds. Users of affected projects are advised to rotate credentials and audit their own pipelines for signs of compromise.
Attribution for the attack remains unclear. The incident adds to a growing pattern of supply chain attacks targeting open-source ecosystems, where malicious code is injected into widely used repositories to reach downstream users.