Affected Systems
73 repositories across Microsoft's official GitHub organizations (Azure, microsoft, Azure-Samples, MicrosoftDocs). Organizations using Microsoft sample code, Azure templates, or CI/CD pipelines referencing these repositories are potentially affected.
Exploitation Status
Active compromise confirmed. GitHub has disabled 73 repositories distributing password-stealing malware. Exploitation occurred through compromise of Microsoft's official GitHub infrastructure, affecting supply chain integrity.
Business Impact
Organizations that cloned, forked, or integrated code from affected Microsoft repositories may have ingested malicious code into development or production environments. CI/CD pipelines referencing these repos are disrupted. Credentials and sensitive data may have been exfiltrated from developer workstations or build systems. Trust in Microsoft's official code distribution channels is undermined.
Urgency
🔴 Immediate
Recommended Actions
- Audit all repositories, CI/CD pipelines, and build systems for dependencies on Microsoft GitHub organizations (Azure, microsoft, Azure-Samples, MicrosoftDocs) cloned or updated in the past 30 days
- Review developer workstation and build server logs for outbound connections to unknown domains, focusing on systems that accessed Microsoft sample code or Azure templates
- Rotate credentials and API keys on any systems that pulled code from affected Microsoft repositories, prioritizing production secrets and service accounts
- Implement repository integrity checks using commit signature verification and pin dependencies to specific verified commit hashes rather than branches
- Monitor Microsoft security advisories and GitHub Security Lab for list of specific affected repositories and indicators of compromise