The tools were built to help people code with AI. Instead, they quietly stole passwords.
Microsoft has pulled dozens of its own projects offline. Hackers had hidden bad code inside them.
At least 70 Microsoft projects went dark. They sit on GitHub, the code site Microsoft owns.
These are open source projects. That just means the code is public for anyone to use.
Many were tied to Azure, Microsoft's cloud service. Others were tools coders use to build with AI.
Those apps include Claude Code, Gemini, and VS Code. A coder would open one of the tools as normal.
Then the hidden code went to work. It grabbed their passwords and logins.
The bad code aimed at people who build with AI. That's a fast-growing group.
Two security teams caught it early. They go by Cloudsmith and OpenSourceMalware.
The news site 404 Media first reported the takedown.
Microsoft says it pulled the projects to look into them. It later put some back after a review.
A warning now loads on the blocked pages. It says access was turned off for breaking the rules.
GitHub is owned by Microsoft, so it could act fast.
Hacks like this keep moving markets. We cover the ones that matter each morning in Market Briefs, plus a free investing masterclass when you join.
This kind of hack has a name. It's called a supply chain attack.
Hackers don't go after you directly. Instead, they poison shared code.
That code then lands inside lots of other software.
It's a smart target. Coders often hold the keys to cloud systems and customer data.
What stands out here is the victim. Small projects get hit all the time, but a giant like Microsoft rarely does.
Big firms have strong security teams. That's why a breach like this is rare for them.
Microsoft is one of the world's most valuable firms. It also owns GitHub, where much of the world's code lives.
So a hit here spreads a long way. And this wasn't a one-off.
It's the second strike in weeks. A Microsoft project called Durable Task was hacked in mid-May.
Experts say this looks like a repeat hit on the same code.
For investors, the trend is the real story. These attacks are on the rise.
Each one can hit thousands of users at once. So the stakes keep going up.
Microsoft also sits in many index funds. So a breach like this draws extra eyes.
Microsoft says it warned the users who may have grabbed the bad code. But it hasn't said how many were hit.
It also hasn't shared a full count of downloads. It says it will reach out if more action is needed.
The firm owns GitHub and still got breached twice in a month. So every team that leans on open source has reason to look twice.
Sign up for the daily Market Briefs newsletter and a 45-minute investing course lands in your inbox at no charge.
