Archive — US — techcrunch
Microsoft’s open source tools were hacked to steal passwords of AI developers
Microsoft suspended access to multiple open-source projects on GitHub after discovering hackers injected password-stealing malware into the code, specifically targeting tools related to AI development. The compromised software risks exposing sensitive user credentials. This incident marks another security breach for Microsoft, following a recent attack on the Durable Task project.
Key points
- Microsoft identified hackers injecting malware into open-source projects on GitHub.
- Affected projects include tools for Azure and various AI development applications.
- The malware steals user passwords and other sensitive information when compromised tools are opened.
- Access to at least 70 projects has been disabled during the investigation.
- Microsoft has notified a small number of potentially affected customers for further action.
- This incident reflects a broader trend of supply chain attacks targeting open-source software.
Why it matters
- This breach follows a recent uptick in supply chain attacks across the tech industry, emphasizing the vulnerability of open-source software.
- The incident highlights increasing security challenges that even large tech firms like Microsoft face in the evolving threat landscape.
- By 2025, open-source software security is projected to be a critical focus as reliance on open-source solutions grows, making vulnerabilities more impactful.
Microsoft's recent malware incident underscores the persistent risks associated with open-source software, especially as supply chain attacks become more common, necessitating stronger security measures within the ecosystem.