supply chain attack

On June 5, 2026, GitHub disabled 73 repositories across Microsoft’s Azure, Microsoft, Azure-Samples, and MicrosoftDocs organizations after a malicious commit was pushed to Azure/durabletask through a reportedly compromised contributor account. The immediate blast radius was not Windows Update or...

Microsoft and GitHub have temporarily disabled at least 70 Microsoft-linked open-source repositories after researchers reported that attackers planted credential-stealing malware in projects tied to Azure, Durable Task, Azure Functions, and AI developer workflows, with the latest public...

Notepad++ users were quietly targeted in a months‑long supply‑chain campaign that did not break the editor’s source code but instead abused its update infrastructure: attackers intercepted and selectively redirected update traffic for certain users between June and December 2025, delivering a...

MicroWorld’s eScan antivirus was used as a delivery vehicle for a malicious update on January 20, 2026, when an unidentified threat actor breached a regional update server and pushed a trojanized update for roughly two hours — a supply‑chain compromise that turned a trusted security tool into a...